include errors.js by default and make it coop with async_task_replace_page (Z#23236752) (#6284)

* load errors.js as standard and make it coop with async_task_replace_page

* scope down event

* Update src/pretix/static/pretixbase/js/asynctask.js

Co-authored-by: pajowu <engelhardt@pretix.eu>

* drop the jquery dependency for error.js

Co-authored-by: pajowu <pajowu@pajowu.de>

* include errors.js in error.html

* include errors.js in control base.html

* Update src/pretix/static/pretixbase/js/asynctask.js

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* put errors.js in an IIFE call

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
Co-authored-by: pajowu <pajowu@pajowu.de>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

.gitlab-ci.yml

@@ -10,8 +10,7 @@ tests:
         - cd src
         - python manage.py check
         - make all compress
-        - playwright install
-        - PRETIX_CONFIG_FILE=tests/ci_sqlite.cfg py.test -n 3 tests --maxfail=100
+        - PRETIX_CONFIG_FILE=tests/ci_sqlite.cfg py.test -n 3 tests --ignore=tests/e2e --maxfail=100
     except:
         - '/^v.*$/'
 pypi:

Dockerfile

@@ -57,8 +57,7 @@ COPY vite.config.ts /pretix/vite.config.ts
 
 RUN pip3 install -U \
         pip \
-        setuptools \
-        wheel && \
+        setuptools && \
     cd /pretix && \
     PRETIX_DOCKER_BUILD=TRUE pip3 install \
         -e ".[memcached]" \

doc/api/resources/carts.rst

@@ -192,7 +192,7 @@ Cart position endpoints
    * ``attendee_email`` (optional)
    * ``subevent`` (optional)
    * ``expires`` (optional)
-   * ``includes_tax`` (optional, **deprecated**, do not use, will be removed)
+   * ``includes_tax`` (optional, **DEPRECATED**, do not use, will be removed)
    * ``sales_channel`` (optional)
    * ``voucher`` (optional, expect a voucher code)
    * ``addons`` (optional, expect a list of nested objects of cart positions)

doc/api/resources/checkin.rst

@@ -46,12 +46,14 @@ Checking a ticket in
                         this request twice with the same nonce, the second request will also succeed but will always
                         create only one check-in object even when the previous request was successful as well. This
                         allows for a certain level of idempotency and enables you to re-try after a connection failure.
+   :<json string exchange_medium_type: To perform an exchange to a reusable medium, pass the type of the new reusable medium
+   :<json string exchange_medium_identifier: To perform an exchange to a reusable media, pass the identifier of the new medium
    :<json boolean use_order_locale: Specifies that pretix should use the customer's language (``locale`` field from the
                                     order) when building texts (currently only the ``reason_explanation`` response field).
                                     Defaults to ``false`` in which case the server will determine the language (currently
                                     the event default language, might change in the future with support for the
                                     ``Accept-Language`` header).
-   :>json string status: ``"ok"``, ``"incomplete"``, or ``"error"``
+   :>json string status: ``"ok"``, ``"incomplete"``, ``"exchange"``, or ``"error"``
    :>json string reason: Reason code, only set on status ``"error"``, see below for possible values.
    :>json string reason_explanation: Human-readable explanation, only set on status ``"error"`` and reason ``"rules"``, can be null.
    :>json object position: Copy of the matching order position (if any was found). The contents are the same as the
@@ -67,6 +69,8 @@ Checking a ticket in
    :>json object list: Excerpt of information about the matching :ref:`check-in list <rest-checkinlists>` (if any was found),
                        including the attributes ``id``, ``name``, ``event``, ``subevent``, and ``include_pending``.
    :>json object questions: List of questions to be answered for check-in, only set on status ``"incomplete"``.
+   :>json object media_policy: Reusable media policy (see documentation on items), only set on status ``"exchange"``.
+   :>json object media_type: Reusable media type (see documentation on items), only set on status ``"exchange"``.
 
    **Example request**:
 
@@ -224,6 +228,9 @@ Checking a ticket in
    * ``ambiguous`` - Multiple tickets match scan, rejected.
    * ``revoked`` - Ticket code has been revoked.
    * ``unapproved`` - Order has not yet been approved.
+   * ``already_exchanged`` - Ticket already has been exchanged for a reusable medium that must now be used for check-in.
+   * ``medium_invalid`` - Reusable medium identifier given was not found or is not valid.
+   * ``medium_exists`` - Reusable medium identifier already exists, but expected to be new.
    * ``error`` - Internal error.
 
    In case of reason ``rules`` and ``invalid_time``, there might be an additional response field ``reason_explanation``

doc/api/resources/checkinlists.rst

@@ -602,7 +602,8 @@ Order position endpoints
 
       We no longer recommend using this API if you're building a ticket scanning application, as it has a few design
       flaws that can lead to `security issues`_ or compatibility issues due to barcode content characters that are not
-      URL-safe. We recommend to use our new :ref:`check-in API <rest-checkin>` instead.
+      URL-safe. We recommend to use our new :ref:`check-in API <rest-checkin>` instead. Advanced features like medium
+      exchange are only supported on the new API.
 
    :query boolean untrusted_input: If set to true, the lookup parameter is **always** interpreted as a ``secret``, never
                                    as an ``id``. This should be always set if you are passing through untrusted, scanned
@@ -741,6 +742,9 @@ Order position endpoints
    * ``ambiguous`` - Multiple tickets match scan, rejected.
    * ``revoked`` - Ticket code has been revoked.
    * ``unapproved`` - Order has not yet been approved.
+   * ``already_exchanged`` - Ticket already has been exchanged for a reusable medium that must now be used for check-in.
+   * ``medium_invalid`` - Reusable medium identifier given was not found and could not be automatically created.
+   * ``medium_exists`` - Reusable medium identifier already exists, but expected to be new.
 
    In case of reason ``rules`` or ``invalid_time``, there might be an additional response field ``reason_explanation``
    with a human-readable description of the violated rules. However, that field can also be missing or be ``null``.

doc/api/resources/items.rst

@@ -131,7 +131,7 @@ allow_waitinglist                       boolean                    If ``false``,
                                                                    product when it is sold out.
 issue_giftcard                          boolean                    If ``true``, buying this product will yield a gift card.
 media_policy                            string                     Policy on how to handle reusable media (experimental feature).
-                                                                   Possible values are ``null``, ``"new"``, ``"reuse"``, and ``"reuse_or_new"``.
+                                                                   Possible values are ``null``, ``"new"``, ``"reuse"``, ``"reuse_or_new"``, ``"append"``, and ``"append_or_new"``.
 media_type                              string                     Type of reusable media to work on (experimental feature). See :ref:`rest-reusablemedia` for possible choices.
 show_quota_left                         boolean                    Publicly show how many tickets are still available.
                                                                    If this is ``null``, the event default is used.

doc/api/resources/orders.rst

@@ -1069,7 +1069,7 @@ Creating orders
       * ``valid_from`` (optional, if both ``valid_from`` and ``valid_until`` are **missing** (not ``null``) the availability will be computed from the given product)
       * ``valid_until`` (optional, if both ``valid_from`` and ``valid_until`` are **missing** (not ``null``) the availability will be computed from the given product)
       * ``requested_valid_from`` (optional, can be set **instead** of ``valid_from`` and ``valid_until`` to signal a user choice for the start time that may or may not be respected)
-      * ``use_reusable_medium`` (optional, causes the new ticket to take over the given reusable medium, identified by its ID)
+      * ``use_reusable_medium`` (optional, causes the new ticket to be connected to the given reusable medium, identified by its ID)
       * ``discount`` (optional, only possible if ``price`` is set; attention: if this is set to not-``null`` on any position, automatic calculation of discounts will not run)
       * ``answers``
 

doc/api/resources/reusablemedia.rst

@@ -21,12 +21,16 @@ id                                    integer                    Internal ID of
 type                                  string                     Type of medium, e.g. ``"barcode"``, ``"nfc_uid"`` or ``"nfc_mf0aes"``.
 organizer                             string                     Organizer slug of the organizer who "owns" this medium.
 identifier                            string                     Unique identifier of the medium. The format depends on the ``type``.
+claim_token                           string                     Secret token to claim ownership of the medium (or ``null``)
+label                                 string                     Label to identify the medium, usually something human readable (or ``null``)
 active                                boolean                    Whether this medium may be used.
 created                               datetime                   Date of creation
 updated                               datetime                   Date of last modification
 expires                               datetime                   Expiry date (or ``null``)
 customer                              string                     Identifier of a customer account this medium belongs to.
-linked_orderposition                  integer                    Internal ID of a ticket this medium is linked to.
+linked_orderpositions                 list of integers           Internal IDs of tickets this medium is linked to.
+linked_orderposition                  integer                    **DEPRECATED.** ID of the ticket the medium is linked to, if it is linked to 
+                                                                 only one ticket. ``null``, if the medium is linked to none or multiple tickets.
 linked_giftcard                       integer                    Internal ID of a gift card this medium is linked to.
 info                                  object                     Additional data, content depends on the ``type``. Consider
                                                                  this internal to the system and don't use it for your own data.
@@ -39,6 +43,14 @@ Existing media types are:
 - ``nfc_uid``
 - ``nfc_mf0aes``
 
+
+.. versionchanged:: 2026.5
+
+   The ``claim_token``, ``label``, ``linked_orderpositions`` attributes have been added, the ``linked_orderposition`` attribute has been
+   deprecated. Note: To maintain backwards compatibility ``linked_orderposition`` contains the internal ID of the linked order position
+   if the medium has exactly one order position in ``linked_orderpositions``.
+
+
 Endpoints
 ---------
 
@@ -77,6 +89,7 @@ Endpoints
             "active": True,
             "expires": None,
             "customer": None,
+            "linked_orderpositions": [],
             "linked_orderposition": None,
             "linked_giftcard": None,
             "notes": None,
@@ -92,10 +105,13 @@ Endpoints
    :query string customer: Only show media linked to the given customer.
    :query string created_since: Only show media created since a given date.
    :query string updated_since: Only show media updated since a given date.
+   :query integer linked_orderpositions: Only show media linked to the given tickets. Note: you can pass multiple ticket IDs by passing
+                                         ``linked_orderpositions`` multiple times. Any medium matching any linked orderposition will be returned.
    :query integer linked_orderposition: Only show media linked to the given ticket.
    :query integer linked_giftcard: Only show media linked to the given gift card.
-   :query string expand: If you pass ``"linked_giftcard"``, ``"linked_giftcard.owner_ticket"``, ``"linked_orderposition"``,
-                         or ``"customer"``, the respective field will be shown as a nested value instead of just an ID.
+   :query string expand: If you pass ``"linked_giftcard"``, ``"linked_giftcard.owner_ticket"``, ``"linked_orderpositions"``,
+                         ``"linked_orderposition"`` (**DEPRECATED**), or ``"customer"``, the respective field will be shown 
+                         as a nested value instead of just an ID.
                          The nested objects are identical to the respective resources, except that order positions
                          will have an attribute of the format ``"order": {"code": "ABCDE", "event": "eventslug"}`` to make
                          matching easier. The parameter can be given multiple times.
@@ -134,6 +150,7 @@ Endpoints
         "active": True,
         "expires": None,
         "customer": None,
+        "linked_orderpositions": [],
         "linked_orderposition": None,
         "linked_giftcard": None,
         "notes": None,
@@ -191,6 +208,7 @@ Endpoints
         "active": True,
         "expires": None,
         "customer": None,
+        "linked_orderpositions": [],
         "linked_orderposition": None,
         "linked_giftcard": None,
         "notes": None,
@@ -198,9 +216,9 @@ Endpoints
       }
 
    :param organizer: The ``slug`` field of the organizer to look up a medium for
-   :query string expand: If you pass ``"linked_giftcard"``, ``"linked_orderposition"``, oder ``"customer"``, the respective
+   :query string expand: If you pass ``"linked_giftcard"``, ``"linked_orderpositions"``, or ``"customer"``, the respective
                          field will be shown as a nested value instead of just an ID. The nested objects are identical to
-                         the respective resources, except that the ``linked_orderposition`` will have an attribute of the
+                         the respective resources, except that the ``linked_orderpositions`` each will have an attribute of the
                          format ``"order": {"code": "ABCDE", "event": "eventslug"}`` to make matching easier. The parameter
                          can be given multiple times.
    :statuscode 201: no error
@@ -227,6 +245,7 @@ Endpoints
         "active": True,
         "expires": None,
         "customer": None,
+        "linked_orderpositions": [],
         "linked_orderposition": None,
         "linked_giftcard": None,
         "notes": None,
@@ -251,6 +270,7 @@ Endpoints
         "active": True,
         "expires": None,
         "customer": None,
+        "linked_orderpositions": [],
         "linked_orderposition": None,
         "linked_giftcard": None,
         "notes": None,
@@ -258,7 +278,7 @@ Endpoints
       }
 
    :param organizer: The ``slug`` field of the organizer to create a medium for
-   :query string expand: If you pass ``"linked_giftcard"``, ``"linked_orderposition"``, oder ``"customer"``, the respective
+   :query string expand: If you pass ``"linked_giftcard"``, ``"linked_orderpositions"``, or ``"customer"``, the respective
                          field will be shown as a nested value instead of just an ID. The nested objects are identical to
                          the respective resources, except that the ``linked_orderposition`` will have an attribute of the
                          format ``"order": {"code": "ABCDE", "event": "eventslug"}`` to make matching easier. The parameter
@@ -287,7 +307,7 @@ Endpoints
       Content-Length: 94
 
       {
-        "linked_orderposition": 13
+        "linked_orderpositions": [13, 29]
       }
 
    **Example response**:
@@ -308,7 +328,8 @@ Endpoints
         "active": True,
         "expires": None,
         "customer": None,
-        "linked_orderposition": 13,
+        "linked_orderpositions": [13, 29],
+        "linked_orderposition": None,
         "linked_giftcard": None,
         "notes": None,
         "info": {}
@@ -316,7 +337,7 @@ Endpoints
 
    :param organizer: The ``slug`` field of the organizer to modify
    :param id: The ``id`` field of the medium to modify
-   :query string expand: If you pass ``"linked_giftcard"``, ``"linked_orderposition"``, oder ``"customer"``, the respective
+   :query string expand: If you pass ``"linked_giftcard"``, ``"linked_orderpositions"``, or ``"customer"``, the respective
                          field will be shown as a nested value instead of just an ID. The nested objects are identical to
                          the respective resources, except that the ``linked_orderposition`` will have an attribute of the
                          format ``"order": {"code": "ABCDE", "event": "eventslug"}`` to make matching easier. The parameter

doc/development/api/general.rst

@@ -64,8 +64,8 @@ Backend
 
 .. automodule:: pretix.control.signals
    :members: nav_event, html_head, html_page_start, quota_detail_html, nav_topbar, nav_global, nav_organizer, nav_event_settings,
-             order_info, event_settings_widget, oauth_application_registered, order_position_buttons, subevent_forms,
-             item_formsets, order_search_filter_q, order_search_forms
+             order_info, order_approve_info, event_settings_widget, oauth_application_registered,
+             order_position_buttons, subevent_forms, item_formsets, order_search_filter_q, order_search_forms, subevent_detail_html
 
 .. automodule:: pretix.base.signals
    :no-index:

pyproject.toml

@@ -29,11 +29,11 @@ classifiers = [
 dependencies = [
   "arabic-reshaper==3.0.1",  # Support for Arabic in reportlab
   "babel",
-  "BeautifulSoup4==4.14.*",
-  "bleach==6.3.*",
+  "BeautifulSoup4==4.15.*",
+  "bleach==6.4.*",
   "celery==5.6.*",
   "chardet==5.2.*",
-  "cryptography>=48.0.0",
+  "cryptography>=48.0.1",
   "css-inline==0.20.*",
   "defusedcsv>=3.0.0",
   "dnspython==2.*",
@@ -93,7 +93,7 @@ dependencies = [
   "redis==7.4.*",
   "reportlab==4.5.*",
   "requests==2.32.*",
-  "sentry-sdk==2.60.*",
+  "sentry-sdk==2.62.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",
@@ -108,10 +108,10 @@ dependencies = [
 [project.optional-dependencies]
 memcached = ["pylibmc"]
 dev = [
-  "aiohttp==3.13.*",
+  "aiohttp==3.14.*",
   "coverage",
   "coveralls",
-  "fakeredis==2.35.*",
+  "fakeredis==2.36.*",
   "flake8==7.3.*",
   "freezegun",
   "isort==8.0.*",
@@ -139,8 +139,6 @@ build-backend = "backend"
 backend-path = ["_build"]
 requires = [
   "setuptools",
-  "setuptools-rust",
-  "wheel",
   "importlib_metadata",
   "tomli",
 ]

src/pretix/__init__.py

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.5.0"
+__version__ = "2026.6.0.dev0"

src/pretix/api/auth/devicesecurity.py

@@ -110,6 +110,8 @@ class PretixScanSecurityProfile(AllowListSecurityProfile):
         ('POST', 'api-v1:checkinrpc.redeem'),
         ('GET', 'api-v1:checkinrpc.search'),
         ('GET', 'api-v1:reusablemedium-list'),
+        ('POST', 'api-v1:reusablemedium-lookup'),
+        ('PATCH', 'api-v1:reusablemedium-detail')
     )
 
 

src/pretix/api/serializers/checkin.py

@@ -88,11 +88,19 @@ class CheckinRPCRedeemInputSerializer(serializers.Serializer):
     nonce = serializers.CharField(required=False, allow_null=True)
     datetime = serializers.DateTimeField(required=False, allow_null=True)
     answers = serializers.JSONField(required=False, allow_null=True)
+    exchange_medium_type = serializers.ChoiceField(required=False, choices=MEDIA_TYPES)
+    exchange_medium_identifier = serializers.CharField(required=False)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.fields['lists'].child_relation.queryset = CheckinList.objects.filter(event__in=self.context['events']).select_related('event')
 
+    def validate(self, attrs):
+        exchange_fields = ["exchange_medium_type", "exchange_medium_identifier"]
+        if any(attrs.get(k) is None for k in exchange_fields) and not all(attrs.get(k) is None for k in exchange_fields):
+            raise ValidationError("If you set any of exchange_medium_type or exchange_medium_identifier, you need to set both of them.")
+        return attrs
+
 
 class MiniCheckinListSerializer(I18nAwareModelSerializer):
     event = serializers.SlugRelatedField(slug_field='slug', read_only=True)

src/pretix/api/serializers/event.py

@@ -871,6 +871,7 @@ class EventSettingsSerializer(SettingsSerializer):
         'og_image',
         'name_scheme',
         'reusable_media_active',
+        'reusable_media_usage_enforced',
         'reusable_media_type_barcode',
         'reusable_media_type_barcode_identifier_length',
         'reusable_media_type_nfc_uid',
@@ -885,6 +886,7 @@ class EventSettingsSerializer(SettingsSerializer):
     readonly_fields = [
         # These are read-only since they are currently only settable on organizers, not events
         'reusable_media_active',
+        'reusable_media_usage_enforced',
         'reusable_media_type_barcode',
         'reusable_media_type_barcode_identifier_length',
         'reusable_media_type_nfc_uid',
@@ -970,6 +972,7 @@ class DeviceEventSettingsSerializer(EventSettingsSerializer):
         'reusable_media_type_nfc_uid',
         'reusable_media_type_nfc_mf0aes',
         'reusable_media_type_nfc_mf0aes_random_uid',
+        'reusable_media_usage_enforced',
         'system_question_order',
         'tax_rule_payment',
         'tax_rule_cancellation',

src/pretix/api/serializers/media.py

@@ -66,13 +66,14 @@ class ReusableMediaSerializer(I18nAwareModelSerializer):
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
+        expand_nested = self.context['request'].query_params.getlist('expand')
 
-        if 'linked_giftcard' in self.context['request'].query_params.getlist('expand'):
+        if 'linked_giftcard' in expand_nested:
             if not self.context["can_read_giftcards"]:
                 raise PermissionDenied("No permission to access gift card details.")
 
             self.fields['linked_giftcard'] = NestedGiftCardSerializer(read_only=True, context=self.context)
-            if 'linked_giftcard.owner_ticket' in self.context['request'].query_params.getlist('expand'):
+            if 'linked_giftcard.owner_ticket' in expand_nested:
                 self.fields['linked_giftcard'].fields['owner_ticket'] = NestedOrderPositionSerializer(read_only=True, context=self.context)
         else:
             self.fields['linked_giftcard'] = serializers.PrimaryKeyRelatedField(
@@ -81,17 +82,27 @@ class ReusableMediaSerializer(I18nAwareModelSerializer):
                 queryset=self.context['organizer'].issued_gift_cards.all()
             )
 
-        if 'linked_orderposition' in self.context['request'].query_params.getlist('expand'):
-            # Permission Check performed in to_representation
-            self.fields['linked_orderposition'] = NestedOrderPositionSerializer(read_only=True)
+        # keep linked_orderposition (singular) for backwards compatibility, will be overwritten in self.validate
+        self.fields['linked_orderposition'] = serializers.PrimaryKeyRelatedField(
+            required=False,
+            allow_null=True,
+            queryset=OrderPosition.all.filter(order__event__organizer=self.context['organizer']),
+        )
+
+        if 'linked_orderposition' in expand_nested or 'linked_orderpositions' in expand_nested:
+            self.fields['linked_orderpositions'] = NestedOrderPositionSerializer(
+                many=True,
+                read_only=True
+            )
         else:
-            self.fields['linked_orderposition'] = serializers.PrimaryKeyRelatedField(
+            self.fields['linked_orderpositions'] = serializers.PrimaryKeyRelatedField(
+                many=True,
                 required=False,
                 allow_null=True,
                 queryset=OrderPosition.all.filter(order__event__organizer=self.context['organizer']),
             )
 
-        if 'customer' in self.context['request'].query_params.getlist('expand'):
+        if 'customer' in expand_nested:
             if not self.context["can_read_customers"]:
                 raise PermissionDenied("No permission to access customer details.")
 
@@ -106,6 +117,21 @@ class ReusableMediaSerializer(I18nAwareModelSerializer):
 
     def validate(self, data):
         data = super().validate(data)
+        if 'linked_orderposition' in data:
+            linked_orderposition = data['linked_orderposition']
+            # backwards-compatibility
+            if 'linked_orderpositions' in data:
+                raise ValidationError({
+                    'linked_orderposition': 'You cannot use linked_orderposition and linked_orderpositions at the same time.'
+                })
+            if self.instance and self.instance.linked_orderpositions.count() > 1:
+                raise ValidationError({
+                    'linked_orderposition': 'There are more than one linked_orderposition. You need to use linked_orderpositions.'
+                })
+
+            data['linked_orderpositions'] = [linked_orderposition] if linked_orderposition else []
+            del data['linked_orderposition']
+
         if 'type' in data and 'identifier' in data:
             qs = self.context['organizer'].reusable_media.filter(
                 identifier=data['identifier'], type=data['type']
@@ -121,14 +147,28 @@ class ReusableMediaSerializer(I18nAwareModelSerializer):
     def to_representation(self, instance):
         r = super().to_representation(instance)
         request = self.context.get('request')
+
+        ops = r.get('linked_orderpositions', [])
         # late permission evaluations for checks that depend on the actual linked events
         expand_nested = self.context['request'].query_params.getlist('expand')
         perm_holder = request.auth if isinstance(request.auth, (Device, TeamAPIToken)) else request.user
-        if 'linked_orderposition' in expand_nested:
-            if instance.linked_orderposition is not None:
-                event = instance.linked_orderposition.order.event
+        if ops and 'linked_orderposition' in expand_nested or 'linked_orderpositions' in expand_nested:
+            ops_noperm = []
+            for lop in instance.linked_orderpositions.all():
+                event = lop.order.event
                 if not perm_holder.has_event_permission(event.organizer, event, 'event.orders:read', request):
-                    r['linked_orderposition'] = {'id': instance.linked_orderposition.id}
+                    ops_noperm.append(lop.id)
+            if ops_noperm:
+                ops = [
+                    {'id': op['id']} if op['id'] in ops_noperm
+                    else op
+                    for op in ops
+                ]
+                r['linked_orderpositions'] = ops
+
+        # add linked_orderposition (singular) for backwards compatibility
+        if len(ops) < 2:
+            r['linked_orderposition'] = ops[0] if ops else None
 
         if 'linked_giftcard.owner_ticket' in expand_nested:
             gc = instance.linked_giftcard
@@ -148,10 +188,12 @@ class ReusableMediaSerializer(I18nAwareModelSerializer):
             'updated',
             'type',
             'identifier',
+            'claim_token',
+            'label',
             'active',
             'expires',
             'customer',
-            'linked_orderposition',
+            'linked_orderpositions',
             'linked_giftcard',
             'info',
             'notes',

src/pretix/api/serializers/order.py

@@ -1149,6 +1149,7 @@ class OrderPositionCreateSerializer(I18nAwareModelSerializer):
             raise ValidationError(
                 {'discount': ['You can only specify a discount if you do the price computation, but price is not set.']}
             )
+
         return data
 
 
@@ -1588,7 +1589,7 @@ class OrderCreateSerializer(I18nAwareModelSerializer):
                 pos_data['attendee_name_parts'] = {
                     '_legacy': attendee_name
                 }
-            pos = OrderPosition(**{k: v for k, v in pos_data.items() if k != 'answers' and k != '_quotas' and k != 'use_reusable_medium'})
+            pos = OrderPosition(**{k: v for k, v in pos_data.items() if k not in ('answers', '_quotas', 'use_reusable_medium')})
             if simulate:
                 pos.order = order._wrapped
             else:
@@ -1703,15 +1704,25 @@ class OrderCreateSerializer(I18nAwareModelSerializer):
                         answ.options.add(*options)
 
                 if use_reusable_medium:
-                    use_reusable_medium.linked_orderposition = pos
-                    use_reusable_medium.save(update_fields=['linked_orderposition'])
+                    if pos.item.media_policy not in (Item.MEDIA_POLICY_APPEND, Item.MEDIA_POLICY_APPEND_OR_NEW):
+                        for op_pk in use_reusable_medium.linked_orderpositions.values_list('pk', flat=True):
+                            use_reusable_medium.log_action(
+                                'pretix.reusable_medium.linked_orderposition.removed',
+                                data={
+                                    'linked_orderposition': op_pk,
+                                }
+                            )
+                        use_reusable_medium.linked_orderpositions.set([pos])
+                    else:
+                        use_reusable_medium.linked_orderpositions.add(pos)
                     use_reusable_medium.log_action(
-                        'pretix.reusable_medium.linked_orderposition.changed',
+                        'pretix.reusable_medium.linked_orderposition.added',
                         data={
                             'by_order': order.code,
                             'linked_orderposition': pos.pk,
                         }
                     )
+                    use_reusable_medium.touch()
 
         if not simulate:
             for cp in delete_cps:

src/pretix/api/serializers/organizer.py

@@ -605,6 +605,7 @@ class OrganizerSettingsSerializer(SettingsSerializer):
         'cookie_consent_dialog_button_yes',
         'cookie_consent_dialog_button_no',
         'reusable_media_active',
+        'reusable_media_usage_enforced',
         'reusable_media_type_barcode',
         'reusable_media_type_barcode_identifier_length',
         'reusable_media_type_nfc_uid',

src/pretix/api/views/checkin.py

@@ -69,8 +69,10 @@ from pretix.base.models import (
 from pretix.base.models.orders import PrintLog
 from pretix.base.permissions import AnyPermissionOf
 from pretix.base.services.checkin import (
-    CheckInError, RequiredQuestionsError, SQLLogic, perform_checkin,
+    CheckInError, RequiredMediaExchangeError, RequiredQuestionsError, SQLLogic,
+    perform_checkin,
 )
+from pretix.base.services.media import perform_media_exchange
 from pretix.base.signals import checkin_annulled
 from pretix.helpers import OF_SELF
 
@@ -454,7 +456,8 @@ def _checkin_list_position_queryset(checkinlists, ignore_status=False, ignore_pr
 
 def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force, checkin_type, ignore_unpaid, nonce,
                     untrusted_input, user, auth, expand, pdf_data, request, questions_supported, canceled_supported,
-                    source_type='barcode', legacy_url_support=False, simulate=False, gate=None, use_order_locale=False):
+                    source_type='barcode', legacy_url_support=False, simulate=False, gate=None, use_order_locale=False,
+                    exchange_medium_type=None, exchange_medium_identifier=None):
     if not checkinlists:
         raise ValidationError('No check-in list passed.')
 
@@ -463,6 +466,7 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
 
     device = auth if isinstance(auth, Device) else None
     gate = gate or (auth.gate if isinstance(auth, Device) else None)
+    medium = None
 
     context = {
         'request': request,
@@ -491,6 +495,7 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
     )
     raw_barcode_for_checkin = None
     from_revoked_secret = False
+    reusable_medium_used = None
     if simulate:
         common_checkin_args['__fake_arg_to_prevent_this_from_being_saved'] = True
 
@@ -521,11 +526,12 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
     #    with respecting the force option), or it's a reusable medium (-> proceed with that)
     if not op_candidates:
         try:
-            media = ReusableMedium.objects.select_related('linked_orderposition').active().get(
+            medium = ReusableMedium.objects.active().filter(
+                Exists(ReusableMedium.linked_orderpositions.through.objects.filter(reusablemedium_id=OuterRef('pk')))
+            ).get(
                 organizer_id=checkinlists[0].event.organizer_id,
                 type=source_type,
                 identifier=raw_barcode,
-                linked_orderposition__isnull=False,
             )
             raw_barcode_for_checkin = raw_barcode
         except ReusableMedium.DoesNotExist:
@@ -628,7 +634,9 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
                     'list': MiniCheckinListSerializer(list_by_event[revoked_matches[0].event_id]).data,
                 }, status=400)
         else:
-            if media.linked_orderposition.order.event_id not in list_by_event:
+            linked_ops = medium.linked_orderpositions.all().select_related("order").prefetch_related("addons")
+            linked_event_ids = {op.order.event_id for op in linked_ops}
+            if not any(event_id in list_by_event for event_id in linked_event_ids):
                 # Medium exists but connected ticket is for the wrong event
                 if not simulate:
                     checkinlists[0].event.log_action('pretix.event.checkin.unknown', data={
@@ -654,28 +662,91 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
                     'checkin_texts': [],
                     'list': MiniCheckinListSerializer(checkinlists[0]).data,
                 }, status=404)
-            op_candidates = [media.linked_orderposition]
-            if list_by_event[media.linked_orderposition.order.event_id].addon_match:
-                op_candidates += list(media.linked_orderposition.addons.all())
+            op_candidates = []
+            for op in linked_ops:
+                if op.order.event_id in list_by_event:
+                    reusable_medium_used = medium
+                    op_candidates.append(op)
+                    if list_by_event[op.order.event_id].addon_match:
+                        op_candidates += list(op.addons.all())
 
     # 3. Handle the "multiple options found" case: Except for the unlikely case of a secret being also a valid primary
-    #    key on the same list, we're probably dealing with the ``addon_match`` case here and need to figure out
-    #    which add-on has the right product.
+    #    key on the same list, we're probably dealing with multiple linked_orderpositions or the ``addon_match`` case
+    #    here and need to figure out which op has the right product. This basically is a valid-for-checkin-test on every op.
     if len(op_candidates) > 1:
-        op_candidates_matching_product = [
-            op for op in op_candidates
-            if (
-                (list_by_event[op.order.event_id].addon_match or op.secret == raw_barcode or legacy_url_support) and
-                (list_by_event[op.order.event_id].all_products or op.item_id in {i.pk for i in list_by_event[op.order.event_id].limit_products.all()})
-            )
-        ]
 
-        if len(op_candidates_matching_product) == 0:
-            # None of the found add-ons has the correct product, too bad! We could just error out here, but
+        if not reusable_medium_used:
+            # 3a. First, we clean up that we made an imprecise query above. If a scan is made for multiple check-in lists,
+            # we have queried ``addon_to__secret=raw_barcode``, even if some of the lists in question do not allow addon
+            # matching. So we accept all candidates that match one of these cases:
+            # - Exactly the ticket secret we scanned (because that's always a possible result)
+            # - Exactly the ticket pk we scanned (on legacy endpoints)
+            # - An add-on on a list that allows add-on matching
+            # This is not necessary when a reusable media was used, since in that case we already obeyed list.addon_match
+            # correctly above.
+            op_candidates_filtered = [
+                op for op in op_candidates
+                if (
+                    op.secret == raw_barcode or
+                    list_by_event[op.order.event_id].addon_match or
+                    (str(op.pk) == raw_barcode and legacy_url_support and not untrusted_input)
+                )
+            ]
+        else:
+            op_candidates_filtered = op_candidates
+
+        if len(op_candidates_filtered) > 1:
+            # 3b. If we still have multiple candidates, we filter by product based on the check-in list configuration.
+            # This is relevant for the addon_match scenario where the scanned ticket has multiple add-ons, but only
+            # one is contained in the check-in list used to scan. It makes sense to filter this first, since it is a
+            # "static" check, i.e. scanning the same QR code on the same check-in list will always do the same, no matter
+            # when I scan it, and it is "intentional" filtering in the sense that the admin configured this behaviour
+            # into the check-in list.
+            op_candidates_filtered = [
+                op for op in op_candidates_filtered
+                if list_by_event[op.order.event_id].all_products or op.item_id in {i.pk for i in list_by_event[op.order.event_id].limit_products.all()}
+            ]
+
+        if len(op_candidates_filtered) > 1:
+            # 3c. If we still have multiple candidates, we filter by validity date. This was introduced for the case where
+            # a reusable media refers to two tickets, one currently valid and one expired or in the future. Howeer,
+            # it could in theory also happen with two add-ons being on the same check-in list but without overlapping
+            # validity. It makes sense to filter this "after" the previous checks since it is not "intentional" filtering
+            # configured by the admin but "accidental" filtering that depends on the time of execution.
+            op_candidates_filtered = [
+                op for op in op_candidates_filtered
+                if (
+                    (not op.valid_from or op.valid_from <= datetime) and
+                    (not op.valid_until or op.valid_until > datetime)
+                )
+            ]
+
+        if len(op_candidates_filtered) == 0:
+            # None of the ops is valid today or has the correct product, too bad! We could just error out here, but
             # instead we just continue with *any* product and have it rejected by the check in perform_checkin.
-            # This has the advantage of a better error message.
-            op_candidates = [op_candidates[0]]
-        elif len(op_candidates_matching_product) > 1:
+            # To improve the error message, we select the op that will "work next" or - if none matches - "worked last".
+            op_candidate = None
+            for op in op_candidates:
+                if (
+                    op.valid_from and op.valid_from > datetime and
+                    (not op_candidate or op.valid_from < op_candidate.valid_from)
+                ):
+                    op_candidate = op
+
+            if not op_candidate:
+                # no candidate in the future, get closest in the past
+                for op in op_candidates:
+                    if (
+                        op.valid_until and op.valid_until < datetime and
+                        (not op_candidate or op.valid_until > op_candidate.valid_until)
+                    ):
+                        op_candidate = op
+
+            if not op_candidate:
+                op_candidate = op_candidates[0]
+
+            op_candidates = [op_candidate]
+        elif len(op_candidates_filtered) > 1:
             # It's still ambiguous, we'll error out.
             # We choose the first match (regardless of product) for the logging since it's most likely to be the
             # base product according to our order_by above.
@@ -709,7 +780,7 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
                 'list': MiniCheckinListSerializer(list_by_event[op.order.event_id]).data,
             }, status=400)
         else:
-            op_candidates = op_candidates_matching_product
+            op_candidates = op_candidates_filtered
 
     op = op_candidates[0]
     common_checkin_args['list'] = list_by_event[op.order.event_id]
@@ -721,7 +792,10 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
             if str(q.pk) in answers_data:
                 try:
                     if q.type == Question.TYPE_FILE:
-                        given_answers[q] = _handle_file_upload(answers_data[str(q.pk)], user, auth)
+                        if answers_data[str(q.pk)]:
+                            given_answers[q] = _handle_file_upload(answers_data[str(q.pk)], user, auth)
+                        else:
+                            given_answers[q] = None
                     else:
                         given_answers[q] = q.clean_answer(answers_data[str(q.pk)])
                 except (ValidationError, BaseValidationError):
@@ -734,7 +808,14 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
         locale = op.order.event.settings.locale
     with language(locale):
         try:
-            perform_checkin(
+            if exchange_medium_identifier and medium:
+                # Cannot scan a medium and then request to exchange it
+                raise CheckInError(
+                    gettext('You cannot exchange a medium for a medium.'),
+                    'error'
+                )
+
+            checkin_args = dict(
                 op=op,
                 clist=list_by_event[op.order.event_id],
                 given_answers=given_answers,
@@ -752,7 +833,25 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
                 from_revoked_secret=from_revoked_secret,
                 simulate=simulate,
                 gate=gate,
+                reusable_medium=medium,
             )
+
+            if exchange_medium_identifier:  # other fields are filled, see CheckinRPCRedeemInputSerializer.validate
+                with transaction.atomic():
+                    # Do exchange and check-in atomically, i.e. both succeed or both fail
+                    medium = perform_media_exchange(
+                        organizer=request.organizer,
+                        media_type=exchange_medium_type,
+                        identifier=exchange_medium_identifier,
+                        link_orderposition=op,
+                        user=user,
+                        auth=auth,
+                    )
+                    source_type = medium.media_type.identifier
+                    checkin_args['reusable_medium'] = medium
+                    perform_checkin(**checkin_args)
+            else:
+                perform_checkin(**checkin_args)
         except RequiredQuestionsError as e:
             return Response({
                 'status': 'incomplete',
@@ -764,6 +863,17 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
                 ],
                 'list': MiniCheckinListSerializer(list_by_event[op.order.event_id]).data,
             }, status=400)
+        except RequiredMediaExchangeError as e:
+            return Response({
+                'status': 'exchange',
+                'require_attention': op.require_checkin_attention,
+                'checkin_texts': op.checkin_texts,
+                'position': CheckinListOrderPositionSerializer(op, context=_make_context(context, op.order.event)).data,
+                'media_policy': e.media_policy,
+                'media_type': e.media_type,
+                'list': MiniCheckinListSerializer(list_by_event[op.order.event_id]).data,
+                'reason_explanation': e.msg,
+            }, status=400)
         except CheckInError as e:
             if not simulate:
                 op.order.log_action('pretix.event.checkin.denied', data={
@@ -951,6 +1061,8 @@ class CheckinRPCRedeemView(views.APIView):
             canceled_supported=True,
             request=self.request,  # this is not clean, but we need it in the serializers for URL generation
             legacy_url_support=False,
+            exchange_medium_type=s.validated_data.get('exchange_medium_type'),
+            exchange_medium_identifier=s.validated_data.get('exchange_medium_identifier'),
         )
 
 

src/pretix/api/views/media.py

@@ -53,10 +53,12 @@ with scopes_disabled():
         customer = django_filters.CharFilter(field_name='customer__identifier')
         updated_since = django_filters.IsoDateTimeFilter(field_name='updated', lookup_expr='gte')
         created_since = django_filters.IsoDateTimeFilter(field_name='created', lookup_expr='gte')
+        # backwards-compatible
+        linked_orderposition = django_filters.NumberFilter(field_name='linked_orderpositions__id')
 
         class Meta:
             model = ReusableMedium
-            fields = ['identifier', 'type', 'active', 'customer', 'linked_orderposition', 'linked_giftcard']
+            fields = ['identifier', 'type', 'active', 'customer', 'linked_orderpositions', 'linked_giftcard']
 
 
 class ReusableMediaViewSet(viewsets.ModelViewSet):
@@ -75,7 +77,7 @@ class ReusableMediaViewSet(viewsets.ModelViewSet):
         ).order_by().values('card').annotate(s=Sum('value')).values('s')
         return self.request.organizer.reusable_media.prefetch_related(
             Prefetch(
-                'linked_orderposition',
+                'linked_orderpositions',
                 queryset=OrderPosition.objects.select_related(
                     'order', 'order__event', 'order__event__organizer', 'seat',
                 ).prefetch_related(
@@ -117,14 +119,38 @@ class ReusableMediaViewSet(viewsets.ModelViewSet):
 
     @transaction.atomic()
     def perform_update(self, serializer):
-        ReusableMedium.objects.select_for_update(of=OF_SELF).get(pk=self.get_object().pk)
+        rm = ReusableMedium.objects.select_for_update(of=OF_SELF).get(pk=self.get_object().pk)
+        prev_linked_ops_pks = list(rm.linked_orderpositions.values_list("pk", flat=True))
         inst = serializer.save(identifier=serializer.instance.identifier, type=serializer.instance.type)
-        inst.log_action(
-            'pretix.reusable_medium.changed',
-            user=self.request.user,
-            auth=self.request.auth,
-            data=self.request.data,
-        )
+        linked_ops_pks = inst.linked_orderpositions.values_list("pk", flat=True)
+        for op_pk in prev_linked_ops_pks:
+            if op_pk not in linked_ops_pks:
+                inst.log_action(
+                    'pretix.reusable_medium.linked_orderposition.removed',
+                    user=self.request.user,
+                    auth=self.request.auth,
+                    data={
+                        'linked_orderposition': op_pk,
+                    }
+                )
+        for op_pk in linked_ops_pks:
+            if op_pk not in prev_linked_ops_pks:
+                inst.log_action(
+                    'pretix.reusable_medium.linked_orderposition.added',
+                    user=self.request.user,
+                    auth=self.request.auth,
+                    data={
+                        'linked_orderposition': op_pk,
+                    }
+                )
+        data = {k: v for k, v in self.request.data.items() if k not in ('linked_orderposition', 'linked_orderpositions')}
+        if data:
+            inst.log_action(
+                'pretix.reusable_medium.changed',
+                user=self.request.user,
+                auth=self.request.auth,
+                data=data,
+            )
         return inst
 
     def perform_destroy(self, instance):
@@ -157,7 +183,6 @@ class ReusableMediaViewSet(viewsets.ModelViewSet):
                         type=s.validated_data["type"],
                         identifier=s.validated_data["identifier"],
                     )
-                m.linked_orderposition = None  # not relevant for cross-organizer
                 m.customer = None  # not relevant for cross-organizer
                 s = self.get_serializer(m)
                 return Response({"result": s.data})
@@ -171,7 +196,7 @@ class ReusableMediaViewSet(viewsets.ModelViewSet):
 
             return Response({"result": None})
 
-    @scopes_disabled()  # we are sure enough that get_queryset() is correct, so we save some perforamnce
+    @scopes_disabled()  # we are sure enough that get_queryset() is correct, so we save some performance
     def list(self, request, **kwargs):
         date = serializers.DateTimeField().to_representation(now())
         queryset = self.filter_queryset(self.get_queryset())

src/pretix/api/views/order.py

@@ -194,7 +194,7 @@ with scopes_disabled():
                 )
             ).values('id')
 
-            matching_media = ReusableMedium.objects.filter(identifier=u).values_list('linked_orderposition__order_id', flat=True)
+            matching_media = ReusableMedium.objects.filter(identifier=u).values_list('linked_orderpositions__order_id', flat=True)
 
             mainq = (
                 code
@@ -1034,7 +1034,7 @@ with scopes_disabled():
         search = django_filters.CharFilter(method='search_qs')
 
         def search_qs(self, queryset, name, value):
-            matching_media = ReusableMedium.objects.filter(identifier=value).values_list('linked_orderposition', flat=True)
+            matching_media = ReusableMedium.objects.filter(identifier=value).values_list('linked_orderpositions', flat=True)
             return queryset.filter(
                 Q(secret__istartswith=value)
                 | Q(attendee_name_cached__icontains=value)

src/pretix/base/exporters/reusablemedia.py

@@ -20,12 +20,13 @@
 # <https://www.gnu.org/licenses/>.
 #
 
+from django.db.models import Prefetch
 from django.dispatch import receiver
 from django.utils.formats import date_format
 from django.utils.translation import gettext_lazy as _, pgettext, pgettext_lazy
 
 from ..exporter import ListExporter, OrganizerLevelExportMixin
-from ..models import ReusableMedium
+from ..models import OrderPosition, ReusableMedium
 from ..signals import register_multievent_data_exporters
 
 
@@ -44,7 +45,9 @@ class ReusableMediaExporter(OrganizerLevelExportMixin, ListExporter):
         media = ReusableMedium.objects.filter(
             organizer=self.organizer,
         ).select_related(
-            'customer', 'linked_orderposition', 'linked_giftcard',
+            'customer', 'linked_giftcard',
+        ).prefetch_related(
+            Prefetch('linked_orderpositions', queryset=OrderPosition.objects.select_related("order"))
         ).order_by('created')
 
         headers = [
@@ -61,18 +64,23 @@ class ReusableMediaExporter(OrganizerLevelExportMixin, ListExporter):
         yield headers
         yield self.ProgressSetTotal(total=media.count())
 
+        can_read_giftcards = self.permission_holder.has_organizer_permission(self.organizer, 'organizer.giftcards:read')
+
         for medium in media.iterator(chunk_size=1000):
-            row = [
+            giftcard_secret = medium.linked_giftcard.secret if medium.linked_giftcard_id else ''
+            if giftcard_secret and not can_read_giftcards:
+                giftcard_secret = giftcard_secret[:3] + "…"
+
+            yield [
                 medium.type,
                 medium.identifier,
                 _('Yes') if medium.active else _('No'),
                 date_format(medium.expires, 'SHORT_DATETIME_FORMAT') if medium.expires else '',
                 medium.customer.identifier if medium.customer_id else '',
-                f"{medium.linked_orderposition.order.code}-{medium.linked_orderposition.positionid}" if medium.linked_orderposition_id else '',
-                medium.linked_giftcard.secret if medium.linked_giftcard_id else '',
+                ', '.join([f"{op.order.code}-{op.positionid}" for op in medium.linked_orderpositions.all()]),
+                giftcard_secret,
                 medium.notes,
             ]
-            yield row
 
     def get_filename(self):
         return f'{self.organizer.slug}_media'

src/pretix/base/management/commands/runserver.py

@@ -44,7 +44,8 @@ class Command(Parent):
             # Start the vite server in the background
             vite_server = subprocess.Popen(
                 ["npm", "run", "dev:control"],
-                cwd=Path(__file__).parent.parent.parent.parent.parent
+                cwd=Path(__file__).parent.parent.parent.parent.parent,
+                stdin=subprocess.DEVNULL
             )
 
             def cleanup():

src/pretix/base/media.py

@@ -26,6 +26,7 @@ from django.utils.translation import gettext_lazy as _
 
 class BaseMediaType:
     medium_created_by_server = False
+    medium_created_from_unknown_supported = False
     supports_orderposition = False
     supports_giftcard = False
 
@@ -56,7 +57,7 @@ class BaseMediaType:
     def is_active(self, organizer):
         return organizer.settings.get(f'reusable_media_type_{self.identifier}', as_type=bool, default=False)
 
-    def handle_unknown(self, organizer, identifier, user, auth):
+    def handle_unknown(self, organizer, identifier, user, auth, force_create=False):
         pass
 
     def handle_new(self, organizer, medium, user, auth):
@@ -88,23 +89,32 @@ class NfcUidMediaType(BaseMediaType):
     verbose_name = _('NFC UID-based')
     icon = 'pretixbase/img/media/nfc_uid.svg'
     medium_created_by_server = False
+    medium_created_from_unknown_supported = True
     supports_giftcard = True
-    supports_orderposition = False
+    supports_orderposition = True
 
-    def handle_unknown(self, organizer, identifier, user, auth):
+    def handle_unknown(self, organizer, identifier, user, auth, force_create=False):
         from pretix.base.models import GiftCard, ReusableMedium
 
-        if organizer.settings.get(f'reusable_media_type_{self.identifier}_autocreate_giftcard', as_type=bool):
+        create_giftcard = organizer.settings.get(f'reusable_media_type_{self.identifier}_autocreate_giftcard', as_type=bool)
+        if create_giftcard or force_create:
             if identifier.startswith("08"):
                 # Don't create gift cards for NFC UIDs that start with 08, which represents NFC cards that issue random
                 # UIDs on every read, so they won't be useful.
                 return
             with transaction.atomic():
-                gc = GiftCard.objects.create(
-                    issuer=organizer,
-                    expires=organizer.default_gift_card_expiry,
-                    currency=organizer.settings.get(f'reusable_media_type_{self.identifier}_autocreate_giftcard_currency'),
-                )
+                if create_giftcard:
+                    gc = GiftCard.objects.create(
+                        issuer=organizer,
+                        expires=organizer.default_gift_card_expiry,
+                        currency=organizer.settings.get(f'reusable_media_type_{self.identifier}_autocreate_giftcard_currency'),
+                    )
+                    gc.log_action(
+                        'pretix.giftcards.created',
+                        user=user, auth=auth,
+                    )
+                else:
+                    gc = None
                 m = ReusableMedium.objects.create(
                     type=self.identifier,
                     identifier=identifier,
@@ -116,10 +126,6 @@ class NfcUidMediaType(BaseMediaType):
                     'pretix.reusable_medium.created.auto',
                     user=user, auth=auth,
                 )
-                gc.log_action(
-                    'pretix.giftcards.created',
-                    user=user, auth=auth,
-                )
                 return m
 
 
@@ -129,7 +135,7 @@ class NfcMf0aesMediaType(BaseMediaType):
     icon = 'pretixbase/img/media/nfc_secure.svg'
     medium_created_by_server = False
     supports_giftcard = True
-    supports_orderposition = False
+    supports_orderposition = True
 
     def handle_new(self, organizer, medium, user, auth):
         from pretix.base.models import GiftCard

src/pretix/base/middleware.py

@@ -74,6 +74,7 @@ class LocaleMiddleware(MiddlewareMixin):
 
     def process_request(self, request: HttpRequest):
         language = get_language_from_request(request)
+        region = None
         # Normally, this middleware runs *before* the event is set. However, on event frontend pages it
         # might be run a second time by pretix.presale.EventMiddleware and in this case the event is already
         # set and can be taken into account for the decision.
@@ -94,15 +95,16 @@ class LocaleMiddleware(MiddlewareMixin):
                 if '-' not in language and settings_holder.settings.region:
                     language += '-' + settings_holder.settings.region
                 if settings_holder.settings.region:
-                    set_region(settings_holder.settings.region)
+                    region = settings_holder.settings.region
         else:
             gs = global_settings_object(request)
             if '-' not in language and gs.settings.region:
                 language += '-' + gs.settings.region
             if gs.settings.region:
-                set_region(gs.settings.region)
+                region = gs.settings.region
 
         translation.activate(language)
+        set_region(region)
         request.LANGUAGE_CODE = get_language_without_region()
 
         tzname = None

src/pretix/base/migrations/0300_add_reusablemedium_label.py

@@ -0,0 +1,35 @@
+# Generated by Django 4.2.26 on 2025-11-24 11:32
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("pretixbase", "0299_itemprogramtime_location"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="reusablemedium",
+            name="claim_token",
+            field=models.CharField(max_length=200, null=True),
+        ),
+        migrations.AddField(
+            model_name="reusablemedium",
+            name="label",
+            field=models.CharField(max_length=200, null=True),
+        ),
+        # use temporary related_name "linked_mediums" for ManyToManyField, so we can migrate existing data
+        migrations.AddField(
+            model_name="reusablemedium",
+            name="linked_orderpositions",
+            field=models.ManyToManyField(
+                related_name="linked_mediums", to="pretixbase.orderposition"
+            ),
+        ),
+        migrations.RunSQL(
+            sql="INSERT INTO pretixbase_reusablemedium_linked_orderpositions (reusablemedium_id, orderposition_id) SELECT id, linked_orderposition_id FROM pretixbase_reusablemedium WHERE linked_orderposition_id IS NOT NULL;",
+            reverse_sql="DELETE FROM pretixbase_reusablemedium_linked_orderpositions;",
+        ),
+    ]

src/pretix/base/migrations/0301_reusablemedium_remove_orderposition.py

@@ -0,0 +1,44 @@
+# Generated by Django 4.2.26 on 2025-11-24 11:32
+
+from django.db import migrations, models
+
+
+def reverse(apps, schema_editor):
+    ReusableMedium = apps.get_model('pretixbase', 'ReusableMedium')
+
+    qs = ReusableMedium.linked_orderpositions.through.objects
+    objs = []
+    # get last added orderposition from linked_orderpositions
+    for rm_id, op_id in qs.filter(id__in=qs.values("reusablemedium_id").annotate(max_id=models.Max('id')).values('max_id')).values_list("reusablemedium_id", "orderposition_id"):
+        obj = ReusableMedium(
+            id=rm_id,
+            linked_orderposition_id=op_id,
+        )
+        objs.append(obj)
+
+    ReusableMedium.objects.bulk_update(objs, ['linked_orderposition_id'])
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("pretixbase", "0300_add_reusablemedium_label"),
+    ]
+
+    operations = [
+        # according to the docs, UPDATE FROM should run similarly on sqlite and postgres, but I could not get it to work
+        # so roll back the data migration with code before deleting data from through-table in 0297
+        migrations.RunPython(migrations.RunPython.noop, reverse),
+        migrations.RemoveField(
+            model_name="reusablemedium",
+            name="linked_orderposition",
+        ),
+        # change related_name for new ManyToManyField to previously used linked_media
+        migrations.AlterField(
+            model_name="reusablemedium",
+            name="linked_orderpositions",
+            field=models.ManyToManyField(
+                related_name="linked_media", to="pretixbase.orderposition"
+            ),
+        ),
+    ]

src/pretix/base/models/checkin.py

@@ -346,11 +346,14 @@ class Checkin(models.Model):
     REASON_INCOMPLETE = 'incomplete'
     REASON_ALREADY_REDEEMED = 'already_redeemed'
     REASON_AMBIGUOUS = 'ambiguous'
+    REASON_MEDIUM_INVALID = 'medium_invalid'
+    REASON_MEDIUM_EXISTS = 'medium_exists'
     REASON_ERROR = 'error'
     REASON_BLOCKED = 'blocked'
     REASON_UNAPPROVED = 'unapproved'
     REASON_INVALID_TIME = 'invalid_time'
     REASON_ANNULLED = 'annulled'
+    REASON_ALREADY_EXCHANGED = 'already_exchanged'
     REASONS = (
         (REASON_CANCELED, _('Order canceled')),
         (REASON_INVALID, _('Unknown ticket')),
@@ -366,6 +369,9 @@ class Checkin(models.Model):
         (REASON_UNAPPROVED, _('Order not approved')),
         (REASON_INVALID_TIME, _('Ticket not valid at this time')),
         (REASON_ANNULLED, _('Check-in annulled')),
+        (REASON_ALREADY_EXCHANGED, _('Ticket already exchanged')),
+        (REASON_MEDIUM_INVALID, _('Reusable medium invalid')),
+        (REASON_MEDIUM_EXISTS, _('Reusable medium already exists')),
     )
 
     successful = models.BooleanField(

src/pretix/base/models/items.py

@@ -452,11 +452,16 @@ class Item(LoggedModel):
     MEDIA_POLICY_REUSE = 'reuse'
     MEDIA_POLICY_NEW = 'new'
     MEDIA_POLICY_REUSE_OR_NEW = 'reuse_or_new'
+    MEDIA_POLICY_APPEND = 'append'
+    MEDIA_POLICY_APPEND_OR_NEW = 'append_or_new'
     MEDIA_POLICIES = (
-        (None, _("Don't use re-usable media, use regular one-off tickets")),
-        (MEDIA_POLICY_REUSE, _('Require an existing medium to be re-used')),
+        (None, _("Don't use reusable media, use regular one-off tickets")),
         (MEDIA_POLICY_NEW, _('Require a previously unknown medium to be newly added')),
-        (MEDIA_POLICY_REUSE_OR_NEW, _('Require either an existing or a new medium to be used')),
+        (MEDIA_POLICY_REUSE, _('Require an existing medium to be reused, replacing any previous tickets')),
+        (MEDIA_POLICY_REUSE_OR_NEW, _('Require either an existing or a new medium to be used, replacing any previous tickets')),
+        (MEDIA_POLICY_APPEND, _('Require an existing medium to be reused, adding to any previous tickets')),
+        (MEDIA_POLICY_APPEND_OR_NEW,
+         _('Require either an existing or a new medium to be used, adding to any previous tickets')),
     )
 
     objects = ItemQuerySetManager()
@@ -769,7 +774,7 @@ class Item(LoggedModel):
         null=True, blank=True, max_length=16,
         verbose_name=_('Reusable media policy'),
         help_text=_(
-            'If this product should be stored on a re-usable physical medium, you can attach a physical media policy. '
+            'If this product should be stored on a reusable physical medium, you can attach a physical media policy. '
             'This is not required for regular tickets, which just use a one-time barcode, but only for products like '
             'renewable season tickets or re-chargeable gift card wristbands. '
             'This is an advanced feature that also requires specific configuration of ticketing and printing settings.'
@@ -778,7 +783,7 @@ class Item(LoggedModel):
     media_type = models.CharField(
         max_length=100,
         null=True, blank=True,
-        choices=[(None, _("Don't use re-usable media, use regular one-off tickets"))] + [(k, v) for k, v in MEDIA_TYPES.items()],
+        choices=[(None, _("Don't use reusable media, use regular one-off tickets"))] + [(k, v) for k, v in MEDIA_TYPES.items()],
         verbose_name=_('Reusable media type'),
         help_text=_(
             'Select the type of physical medium that should be used for this product. Note that not all media types '
@@ -995,6 +1000,11 @@ class Item(LoggedModel):
                 raise ValidationError(_('The selected media type does not support usage for tickets currently.'))
             if not mt.supports_giftcard and issue_giftcard:
                 raise ValidationError(_('The selected media type does not support usage for gift cards currently.'))
+            if media_policy in (Item.MEDIA_POLICY_NEW, Item.MEDIA_POLICY_APPEND_OR_NEW, Item.MEDIA_POLICY_REUSE_OR_NEW):
+                if not mt.medium_created_by_server and not mt.medium_created_from_unknown_supported:
+                    raise ValidationError(_('The selected media type requires all media to be registered in the system '
+                                            'prior to their usage. Therefore, the selected media policy does not make '
+                                            'sense for this media type.'))
             if issue_giftcard:
                 raise ValidationError(_('You currently cannot create gift cards with a reusable media policy. Instead, '
                                         'gift cards for some reusable media types can be created or re-charged directly '
@@ -2220,7 +2230,7 @@ class Quota(LoggedModel):
 class ItemMetaProperty(LoggedModel):
     """
     An event can have ItemMetaProperty objects attached to define meta information fields
-    for its items. This information can be re-used for example in ticket layouts.
+    for its items. This information can be reused for example in ticket layouts.
 
     :param event: The event this property is defined for.
     :type event: Event

src/pretix/base/models/media.py

@@ -72,6 +72,16 @@ class ReusableMedium(LoggedModel):
         max_length=200,
         verbose_name=pgettext_lazy('reusable_medium', 'Identifier'),
     )
+    claim_token = models.CharField(
+        max_length=200,
+        verbose_name=pgettext_lazy('reusable_medium', 'Claim token'),
+        null=True, blank=True
+    )
+    label = models.CharField(
+        max_length=200,
+        verbose_name=pgettext_lazy('reusable_medium', 'Label'),
+        null=True, blank=True
+    )
 
     active = models.BooleanField(
         verbose_name=_('Active'),
@@ -89,12 +99,14 @@ class ReusableMedium(LoggedModel):
         on_delete=models.SET_NULL,
         verbose_name=_('Customer account'),
     )
-    linked_orderposition = models.ForeignKey(
+    linked_orderpositions = models.ManyToManyField(
         OrderPosition,
-        null=True, blank=True,
         related_name='linked_media',
-        on_delete=models.SET_NULL,
-        verbose_name=_('Linked ticket'),
+        verbose_name=_('Linked tickets'),
+        help_text=_(
+            'If you link to more than one ticket, make sure there is no overlap in validity. '
+            'If multiple tickets are valid at once, this will lead to failed check-ins.'
+        )
     )
     linked_giftcard = models.ForeignKey(
         GiftCard,
@@ -117,7 +129,10 @@ class ReusableMedium(LoggedModel):
 
     @property
     def is_expired(self):
-        return self.expires and self.expires > now()
+        return self.expires and self.expires < now()
+
+    def touch(self):
+        self.save(update_fields=['updated'])
 
     class Meta:
         unique_together = (("identifier", "type", "organizer"),)

src/pretix/base/services/cart.py

@@ -287,11 +287,11 @@ def _check_position_constraints(
         raise CartPositionError(error_messages['unavailable'])
 
     # Invalid media policy for online sale
-    if item.media_policy in (Item.MEDIA_POLICY_NEW, Item.MEDIA_POLICY_REUSE_OR_NEW):
+    if item.media_policy in (Item.MEDIA_POLICY_NEW, Item.MEDIA_POLICY_REUSE_OR_NEW, Item.MEDIA_POLICY_APPEND_OR_NEW, Item.MEDIA_POLICY_REUSE_OR_NEW):
         mt = MEDIA_TYPES[item.media_type]
         if not mt.medium_created_by_server:
             raise CartPositionError(error_messages['media_usage_not_implemented'])
-    elif item.media_policy == Item.MEDIA_POLICY_REUSE:
+    elif item.media_policy in (Item.MEDIA_POLICY_REUSE, Item.MEDIA_POLICY_APPEND):
         raise CartPositionError(error_messages['media_usage_not_implemented'])
 
     # Item removed from sales channel

src/pretix/base/services/checkin.py

@@ -867,6 +867,15 @@ class RequiredQuestionsError(Exception):
         super().__init__(msg)
 
 
+class RequiredMediaExchangeError(Exception):
+    def __init__(self, msg, code, media_policy, media_type):
+        self.msg = msg
+        self.code = code
+        self.media_policy = media_policy
+        self.media_type = media_type
+        super().__init__(msg)
+
+
 def _save_answers(op, answers, given_answers):
     def _create_answer(question, answer):
         try:
@@ -939,7 +948,7 @@ def perform_checkin(op: OrderPosition, clist: CheckinList, given_answers: dict,
                     ignore_unpaid=False, nonce=None, datetime=None, questions_supported=True,
                     user=None, auth=None, canceled_supported=False, type=Checkin.TYPE_ENTRY,
                     raw_barcode=None, raw_source_type=None, from_revoked_secret=False, simulate=False,
-                    gate=None):
+                    gate=None, reusable_medium=None):
     """
     Create a checkin for this particular order position and check-in list. Fails with CheckInError if the check in is
     not valid at this time.
@@ -955,6 +964,7 @@ def perform_checkin(op: OrderPosition, clist: CheckinList, given_answers: dict,
     :param datetime: The datetime of the checkin, defaults to now.
     :param simulate: If true, the check-in is not saved.
     :param gate: The gate the check-in was performed at.
+    :param reusable_medium: The medium that is available for an exchange
     """
 
     # !!!!!!!!!
@@ -1035,7 +1045,7 @@ def perform_checkin(op: OrderPosition, clist: CheckinList, given_answers: dict,
 
     with transaction.atomic():
         # Lock order positions, if it is an entry. We don't need it for exits, as a race condition wouldn't be problematic
-        opqs = OrderPosition.all
+        opqs = OrderPosition.all.select_related("order", "item")
         if type != Checkin.TYPE_EXIT:
             opqs = opqs.select_for_update(of=OF_SELF)
         op = opqs.get(pk=op.pk)
@@ -1101,6 +1111,24 @@ def perform_checkin(op: OrderPosition, clist: CheckinList, given_answers: dict,
                 require_answers
             )
 
+        required_media_policy = op.item.media_policy
+        required_media_type = op.item.media_type
+        require_a_medium = required_media_policy and required_media_type
+        linked_media = op.linked_media
+        if require_a_medium and not reusable_medium and not force:
+            if not linked_media.exists():
+                raise RequiredMediaExchangeError(
+                    _('Ticket needs to be exchanged to a suitable medium.'),
+                    'exchange',
+                    required_media_policy,
+                    required_media_type
+                )
+            elif op.organizer.settings.reusable_media_usage_enforced:
+                raise CheckInError(
+                    _('This ticket has already been exchanged for a reusable medium that now needs to be used instead.'),
+                    'already_exchanged',
+                )
+
         device = None
         if isinstance(auth, Device):
             device = auth

src/pretix/base/services/media.py

@@ -23,10 +23,13 @@ import secrets
 
 from django.db import IntegrityError
 from django.db.models import Q
+from django.utils.translation import gettext as _
 from django_scopes import scopes_disabled
 
-from pretix.base.models import GiftCardAcceptance
-from pretix.base.models.media import MediumKeySet
+from pretix.base.media import MEDIA_TYPES
+from pretix.base.models import Checkin, GiftCardAcceptance, Item
+from pretix.base.models.media import MediumKeySet, ReusableMedium
+from pretix.base.services.checkin import CheckInError
 
 
 def create_nfc_mf0aes_keyset(organizer):
@@ -70,3 +73,174 @@ def get_keysets_for_organizer(organizer):
         if new_set:
             sets.append(new_set)
     return sets
+
+
+def perform_media_exchange(organizer, media_type, identifier, link_orderposition, user, auth):
+    """
+    Create or retrieve a medium, then link the order position to it. Expected to be called in a transaction.
+
+    :param organizer: Organizer to operate in
+    :param media_type: Type of medium to operate with
+    :param identifier: Identifier of the medium
+    :param link_orderposition: Position to link to the medium
+    :return: ReusableMedium
+    """
+    medium = None
+    media_policy = link_orderposition.item.media_policy
+
+    if media_type not in MEDIA_TYPES:  # should be caught by serializer already
+        raise CheckInError(
+            _('Invalid medium type.'),
+            Checkin.REASON_ERROR,
+            reason=_('Invalid medium type.'),
+        )
+
+    if not MEDIA_TYPES[media_type].is_active(organizer):
+        raise CheckInError(
+            _('Medium type is not enabled for organizer.'),
+            Checkin.REASON_ERROR,
+            reason=_('Medium type is not enabled for organizer.'),
+        )
+
+    if link_orderposition.item.media_type != media_type:
+        raise CheckInError(
+            _('Incorrect medium type for product.'),
+            Checkin.REASON_PRODUCT,
+            reason=_('Incorrect medium type for product.'),
+        )
+
+    if link_orderposition.linked_media.exists():
+        raise CheckInError(
+            _('Ticket is already exchanged for reusable medium.'),
+            Checkin.REASON_ALREADY_EXCHANGED,
+            reason=_('Ticket is already exchanged for reusable medium.'),
+        )
+
+    if media_policy in (Item.MEDIA_POLICY_APPEND, Item.MEDIA_POLICY_APPEND_OR_NEW, Item.MEDIA_POLICY_NEW):
+        link_action = "append"
+    else:
+        link_action = "replace"
+
+    if media_policy in (Item.MEDIA_POLICY_REUSE, Item.MEDIA_POLICY_APPEND):
+        try:
+            medium = ReusableMedium.objects.get(
+                type=media_type,
+                identifier=identifier,
+                organizer=organizer,
+            )
+        except ReusableMedium.DoesNotExist:
+            raise CheckInError(
+                _('Reusable medium not found.'),
+                Checkin.REASON_MEDIUM_INVALID,
+                reason=_('Reusable medium not found.'),
+            )
+        else:
+            if medium.is_expired or not medium.active:
+                raise CheckInError(
+                    _('Reusable medium is inactive or expired.'),
+                    Checkin.REASON_MEDIUM_INVALID,
+                    reason=_('Reusable medium is inactive or expired.'),
+                )
+
+    elif media_policy in (Item.MEDIA_POLICY_REUSE_OR_NEW, Item.MEDIA_POLICY_APPEND_OR_NEW):
+        try:
+            medium = ReusableMedium.objects.get(
+                type=media_type,
+                identifier=identifier,
+                organizer=organizer,
+            )
+        except ReusableMedium.DoesNotExist:
+            if not MEDIA_TYPES[media_type].medium_created_from_unknown_supported:
+                raise CheckInError(
+                    _('Reusable medium not found and could not be created.'),
+                    Checkin.REASON_MEDIUM_INVALID,
+                )
+
+            medium = MEDIA_TYPES[media_type].handle_unknown(organizer, identifier, user, auth, force_create=True)
+            if not medium:
+                raise CheckInError(
+                    _('Reusable medium not found and could not be created.'),
+                    Checkin.REASON_MEDIUM_INVALID,
+                )
+
+        if medium.is_expired or not medium.active:
+            raise CheckInError(
+                _('Reusable medium is inactive or expired.'),
+                Checkin.REASON_MEDIUM_INVALID,
+                reason=_('Reusable medium is inactive or expired.'),
+            )
+
+    elif media_policy == Item.MEDIA_POLICY_NEW:
+        if not MEDIA_TYPES[media_type].medium_created_from_unknown_supported:
+            raise CheckInError(
+                _('Reusable medium not found and could not be created.'),
+                Checkin.REASON_MEDIUM_INVALID,
+            )
+        try:
+            medium = MEDIA_TYPES[media_type].handle_unknown(organizer, identifier, user, auth, force_create=True)
+        except IntegrityError:
+            raise CheckInError(
+                _('Reusable medium already exists.'),
+                Checkin.REASON_MEDIUM_EXISTS,
+            )
+        else:
+            if not medium:
+                raise CheckInError(
+                    _('Reusable medium could not be created.'),
+                    Checkin.REASON_MEDIUM_INVALID,
+                )
+
+    else:
+        raise CheckInError(
+            _('Product does not support medium exchange.'),
+            Checkin.REASON_PRODUCT,
+            reason=_('Product does not support medium exchange.'),
+        )
+
+    if link_action == 'append':
+        medium.linked_orderpositions.add(link_orderposition)
+        medium.log_action(
+            'pretix.reusable_medium.linked_orderposition.added',
+            user=user,
+            auth=auth,
+            data={
+                'linked_orderposition': link_orderposition,
+            }
+        )
+    elif link_action == 'replace':
+        already_found = False
+        for op_pk in medium.linked_orderpositions.values_list('pk', flat=True):
+            if op_pk == link_orderposition.pk:
+                already_found = True
+                continue
+            else:
+                medium.log_action(
+                    'pretix.reusable_medium.linked_orderposition.removed',
+                    data={
+                        'linked_orderposition': op_pk,
+                    }
+                )
+        if not already_found:
+            medium.linked_orderpositions.set([link_orderposition])
+            medium.log_action(
+                'pretix.reusable_medium.linked_orderposition.added',
+                user=user,
+                auth=auth,
+                data={
+                    'linked_orderposition': link_orderposition,
+                }
+            )
+
+    link_orderposition.order.log_action(
+        'pretix.reusable_medium.exchanged',
+        data={
+            'position': link_orderposition.pk,
+            'positionid': link_orderposition.positionid,
+            'medium': medium.pk,
+            'medium_identifier': medium.identifier,
+            'medium_type': medium.media_type.identifier,
+        }
+    )
+    medium.touch()
+
+    return medium

src/pretix/base/services/orders.py

@@ -3506,7 +3506,7 @@ def signal_listener_issue_media(sender: Event, order: Order, **kwargs):
     from pretix.base.models import ReusableMedium
 
     for p in order.positions.all():
-        if p.item.media_policy in (Item.MEDIA_POLICY_NEW, Item.MEDIA_POLICY_REUSE_OR_NEW):
+        if p.item.media_policy in (Item.MEDIA_POLICY_NEW, Item.MEDIA_POLICY_REUSE_OR_NEW, Item.MEDIA_POLICY_APPEND_OR_NEW):
             mt = MEDIA_TYPES[p.item.media_type]
             if mt.medium_created_by_server and not p.linked_media.exists():
                 rm = ReusableMedium.objects.create(
@@ -3515,8 +3515,8 @@ def signal_listener_issue_media(sender: Event, order: Order, **kwargs):
                     identifier=mt.generate_identifier(sender.organizer),
                     active=True,
                     customer=order.customer,
-                    linked_orderposition=p,
                 )
+                rm.linked_orderpositions.add(p)
                 rm.log_action(
                     'pretix.reusable_medium.created',
                     data={

src/pretix/base/settings.py

@@ -211,12 +211,25 @@ DEFAULTS = {
         'form_class': forms.BooleanField,
         'serializer_class': serializers.BooleanField,
         'form_kwargs': dict(
-            label=_("Activate re-usable media"),
-            help_text=_("The re-usable media feature allows you to connect tickets and gift cards with physical media "
-                        "such as wristbands or chip cards that may be re-used for different tickets or gift cards "
+            label=_("Activate reusable media"),
+            help_text=_("The reusable media feature allows you to connect tickets and gift cards with physical media "
+                        "such as wristbands or chip cards that may be reused for different tickets or gift cards "
                         "later.")
         )
     },
+    'reusable_media_usage_enforced': {
+        'default': 'False',
+        'type': bool,
+        'form_class': forms.BooleanField,
+        'serializer_class': serializers.BooleanField,
+        'form_kwargs': dict(
+            label=_("Enforce the usage of issued reusable media for check-in"),
+            help_text=_("If enabled, a ticket barcode will not be accepted anymore, if a reusable medium has been "
+                        "created and linked to a ticket. Keeping this option turned off will treat the reusable "
+                        "medium and ticket as equals."),
+            widget=forms.CheckboxInput(attrs={'data-display-dependency': '#id_settings-reusable_media_active'}),
+        )
+    },
     'reusable_media_type_barcode': {
         'default': 'False',
         'type': bool,

src/pretix/base/templates/error.html

@@ -11,6 +11,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <meta charset="utf-8">
     <link rel="icon" href="{% static "pretixbase/img/favicon.ico" %}">
+    <script type="text/javascript" src="{% static "pretixbase/js/errors.js" %}"></script>
     {% block custom_header %}{% endblock %}
     {% if css_theme %}
         <link rel="stylesheet" type="text/css" href="{{ css_theme }}" />
@@ -21,5 +22,4 @@
     {% block content %}{% endblock %}
 </div>
 </body>
-<script src="{% static "pretixbase/js/errors.js" %}"></script>
 </html>

src/pretix/control/forms/__init__.py

@@ -461,3 +461,31 @@ class SalesChannelCheckboxSelectMultiple(forms.CheckboxSelectMultiple):
             **super().create_option(name, value, label, selected, index, subindex, attrs),
             "plugin_missing": plugin and plugin not in self.event.get_plugins(),
         }
+
+
+class ModelChoiceIteratorWithNone(forms.models.ModelChoiceIterator):
+    # see django.forms.models.ModelChoiceIterator for original implementation
+    def __iter__(self):
+        if self.field.empty_label is not None:
+            yield ("", self.field.empty_label)
+        if self.field.none_label is not None:
+            yield ("_none", self.field.none_label)
+        queryset = self.queryset
+        # Can't use iterator() when queryset uses prefetch_related()
+        if not queryset._prefetch_related_lookups:
+            queryset = queryset.iterator()
+        for obj in queryset:
+            yield self.choice(obj)
+
+
+class ModelChoiceFieldWithNone(forms.ModelChoiceField):
+    iterator = ModelChoiceIteratorWithNone
+
+    def __init__(self, *args, **kwargs):
+        self.none_label = kwargs.pop("none_label", None)
+        super().__init__(*args, **kwargs)
+
+    def to_python(self, value):
+        if value == "_none":
+            return value
+        return super().to_python(value)

src/pretix/control/forms/filter.py

@@ -1342,7 +1342,13 @@ class QuestionAnswerFilterForm(forms.Form):
             opqs = opqs.filter(canceled=False)
         if fdata.get("item", "") != "":
             i = fdata.get("item", "")
-            opqs = opqs.filter(item_id__in=(i,))
+            if '-' in i:
+                opqs = opqs.filter(
+                    item_id=i.split('-')[0],
+                    variation_id=i.split('-')[1],
+                )
+            else:
+                opqs = opqs.filter(item_id=i)
 
         return opqs
 
@@ -1871,7 +1877,7 @@ class ReusableMediaFilterForm(FilterForm):
                 Q(identifier__icontains=query)
                 | Q(customer__identifier__icontains=query)
                 | Q(customer__external_identifier__istartswith=query)
-                | Q(linked_orderposition__order__code__icontains=query)
+                | Q(linked_orderpositions__order__code__icontains=query)
                 | Q(linked_giftcard__secret__icontains=query)
             )
 

src/pretix/control/forms/organizer.py

@@ -86,7 +86,7 @@ from pretix.control.forms import ExtFileField, SplitDateTimeField
 from pretix.control.forms.event import (
     SafeEventMultipleChoiceField, multimail_validate,
 )
-from pretix.control.forms.widgets import Select2
+from pretix.control.forms.widgets import Select2, Select2Multiple
 from pretix.multidomain.models import KnownDomain
 from pretix.multidomain.urlreverse import build_absolute_uri
 
@@ -249,6 +249,15 @@ class SafeOrderPositionChoiceField(forms.ModelChoiceField):
         return f'{op.order.code}-{op.positionid} ({str(op.item) + ((" - " + str(op.variation)) if op.variation else "")})'
 
 
+class SafeOrderPositionMultipleChoiceField(forms.ModelMultipleChoiceField):
+    def __init__(self, queryset, **kwargs):
+        queryset = queryset.model.all.none()
+        super().__init__(queryset, **kwargs)
+
+    def label_from_instance(self, op):
+        return f'{op.order.code}-{op.positionid} ({str(op.item) + ((" - " + str(op.variation)) if op.variation else "")})'
+
+
 class EventMetaPropertyForm(I18nModelForm):
     class Meta:
         model = EventMetaProperty
@@ -627,6 +636,7 @@ class OrganizerSettingsForm(SettingsForm):
         'cookie_consent_dialog_button_yes',
         'cookie_consent_dialog_button_no',
         'reusable_media_active',
+        'reusable_media_usage_enforced',
         'reusable_media_type_barcode',
         'reusable_media_type_barcode_identifier_length',
         'reusable_media_type_nfc_uid',
@@ -963,12 +973,12 @@ class ReusableMediumUpdateForm(forms.ModelForm):
 
     class Meta:
         model = ReusableMedium
-        fields = ['active', 'expires', 'customer', 'linked_giftcard', 'linked_orderposition', 'notes']
+        fields = ['active', 'expires', 'customer', 'linked_giftcard', 'linked_orderpositions', 'notes']
         field_classes = {
             'expires': SplitDateTimeField,
             'customer': SafeModelChoiceField,
             'linked_giftcard': SafeModelChoiceField,
-            'linked_orderposition': SafeOrderPositionChoiceField,
+            'linked_orderpositions': SafeOrderPositionMultipleChoiceField,
         }
         widgets = {
             'expires': SplitDateTimePickerWidget,
@@ -978,8 +988,8 @@ class ReusableMediumUpdateForm(forms.ModelForm):
         super().__init__(*args, **kwargs)
         organizer = self.instance.organizer
 
-        self.fields['linked_orderposition'].queryset = OrderPosition.all.filter(order__event__organizer=organizer).all()
-        self.fields['linked_orderposition'].widget = Select2(
+        self.fields['linked_orderpositions'].queryset = OrderPosition.all.filter(order__event__organizer=organizer).all()
+        self.fields['linked_orderpositions'].widget = Select2Multiple(
             attrs={
                 'data-model-select2': 'generic',
                 'data-select2-url': reverse('control:organizer.ticket_select2', kwargs={
@@ -987,8 +997,8 @@ class ReusableMediumUpdateForm(forms.ModelForm):
                 }),
             }
         )
-        self.fields['linked_orderposition'].widget.choices = self.fields['linked_orderposition'].choices
-        self.fields['linked_orderposition'].required = False
+        self.fields['linked_orderpositions'].widget.choices = self.fields['linked_orderpositions'].choices
+        self.fields['linked_orderpositions'].required = False
 
         self.fields['linked_giftcard'].queryset = organizer.issued_gift_cards.all()
         self.fields['linked_giftcard'].widget = Select2(
@@ -1042,12 +1052,12 @@ class ReusableMediumCreateForm(ReusableMediumUpdateForm):
 
     class Meta:
         model = ReusableMedium
-        fields = ['active', 'type', 'identifier', 'expires', 'linked_orderposition', 'linked_giftcard', 'customer', 'notes']
+        fields = ['active', 'type', 'identifier', 'expires', 'linked_orderpositions', 'linked_giftcard', 'customer', 'notes']
         field_classes = {
             'expires': SplitDateTimeField,
             'customer': SafeModelChoiceField,
             'linked_giftcard': SafeModelChoiceField,
-            'linked_orderposition': SafeOrderPositionChoiceField,
+            'linked_orderpositions': SafeOrderPositionMultipleChoiceField,
         }
         widgets = {
             'expires': SplitDateTimePickerWidget,

src/pretix/control/forms/widgets.py

@@ -29,17 +29,30 @@ class Select2Mixin:
         super().__init__(*args, **kwargs)
 
     def options(self, name, value, attrs=None):
-        if value and value[0]:
-            for i, selected in enumerate(self.choices.queryset.filter(pk__in=value)):
-                yield self.create_option(
-                    None,
-                    self.choices.field.prepare_value(selected),
-                    self.choices.field.label_from_instance(selected),
-                    True,
-                    i,
-                    subindex=None,
-                    attrs=attrs
-                )
+        if not value or not value[0]:
+            return
+        has_none = "_none" in value
+        if has_none:
+            value = [v for v in value if v != "_none"]
+            yield self.create_option(
+                None,
+                "_none",
+                self.choices.field.none_label,
+                True,
+                0,
+                subindex=None,
+                attrs=attrs
+            )
+        for i, selected in enumerate(self.choices.queryset.filter(pk__in=value)):
+            yield self.create_option(
+                None,
+                self.choices.field.prepare_value(selected),
+                self.choices.field.label_from_instance(selected),
+                True,
+                i + (1 if has_none else 0),
+                subindex=None,
+                attrs=attrs
+            )
         return
 
     def optgroups(self, name, value, attrs=None):

src/pretix/control/logdisplay.py

@@ -743,7 +743,10 @@ class CoreUserImpersonatedLogEntryType(UserImpersonatedLogEntryType):
     'pretix.reusable_medium.created': _('The reusable medium has been created.'),
     'pretix.reusable_medium.created.auto': _('The reusable medium has been created automatically.'),
     'pretix.reusable_medium.changed': _('The reusable medium has been changed.'),
+    'pretix.reusable_medium.linked_orderposition.added': _('A new ticket has been added to the medium.'),
+    'pretix.reusable_medium.linked_orderposition.removed': _('A ticket has been removed from the medium.'),
     'pretix.reusable_medium.linked_orderposition.changed': _('The medium has been connected to a new ticket.'),
+    'pretix.reusable_medium.exchanged': _('The ticket #{positionid} was exchanged for reusable medium {medium_identifier}.'),
     'pretix.reusable_medium.linked_giftcard.changed': _('The medium has been connected to a new gift card.'),
     'pretix.email.error': _('Sending of an email has failed.'),
     'pretix.event.comment': _('The event\'s internal comment has been updated.'),

src/pretix/control/signals.py

@@ -213,6 +213,16 @@ quota as argument in the ``quota`` keyword argument.
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
 
+subevent_detail_html = EventPluginSignal()
+"""
+Arguments: 'subevent'
+
+This signal allows you to append HTML to a SubEvent's detail view. You receive the
+subevent as argument in the ``subevent`` keyword argument.
+
+As with all event plugin signals, the ``sender`` keyword argument will contain the event.
+"""
+
 organizer_edit_tabs = DeprecatedSignal()
 """
 Arguments: 'organizer', 'request'
@@ -261,6 +271,16 @@ As with all event plugin signals, the ``sender`` keyword argument will contain t
 Additionally, the argument ``order`` and ``request`` are available.
 """
 
+order_approve_info = EventPluginSignal()
+"""
+Arguments: ``order``, ``request``
+
+This signal is sent out to display additional information on the order approve page
+
+As with all event plugin signals, the ``sender`` keyword argument will contain the event.
+Additionally, the argument ``order`` and ``request`` are available.
+"""
+
 order_position_buttons = EventPluginSignal()
 """
 Arguments: ``order``, ``position``, ``request``

src/pretix/control/templates/pretixcontrol/base.html

@@ -66,6 +66,7 @@
             <script type="text/javascript" src="{% static "lightbox/js/lightbox.js" %}"></script>
             <script type="text/javascript" src="{% static "are-you-sure/jquery.are-you-sure.js" %}"></script>
             <script type="text/javascript" src="{% static "pretixbase/js/addressform.js" %}"></script>
+            <script type="text/javascript" src="{% static "pretixbase/js/errors.js" %}"></script>
 		{% endcompress %}
         {{ html_head|safe }}
 

src/pretix/control/templates/pretixcontrol/checkin/simulator.html

@@ -54,6 +54,8 @@
                     <span class="fa fa-check-circle"></span>
                 {% elif result.status == "incomplete" %}
                     <span class="fa fa-question-circle"></span>
+                {% elif result.status == "exchange" %}
+                    <span class="fa fa-recycle"></span>
                 {% elif result.status == "error" %}
                     {% if result.reason == "already_redeemed" %}
                         <span class="fa fa-warning"></span>
@@ -79,6 +81,14 @@
                             </li>
                         {% endfor %}
                     </ul>
+                {% elif result.status == "exchange" %}
+                    <h3 class="nomargin-top">{% trans "Media exchange required" %}</h3>
+                    <p>
+                        {% blocktrans trimmed with media_policy=media_policies|getitem:result.media_policy media_type=media_types|getitem:result.media_type %}
+                            This ticket needs to be exchanged into a <strong>{{ media_type }}</strong> reusable medium.
+                            <strong>{{ media_policy }}</strong>.
+                        {% endblocktrans %}
+                    </p>
                 {% elif result.status == "error" %}
                     <h3 class="nomargin-top">{{ reason_labels|getitem:result.reason }}</h3>
                     {% if result.reason_explanation %}

src/pretix/control/templates/pretixcontrol/event/dangerzone.html

@@ -9,23 +9,24 @@
             <h3 class="panel-title">{% trans "Go offline" %}</h3>
         </div>
         <div class="row panel-body">
-            <div class="col-sm-12 col-md-9 nomargin-bottom">
+            <div class="col-sm-12 col-lg-6">
+                <p>
                 {% blocktrans trimmed %}
                     You can take your event offline. Nobody except your team will be able to see or access it any more.
                 {% endblocktrans %}
-            </div>
-            <div class="col-sm-12 col-md-3">
-                <form action="{% url "control:event.live" event=request.event.slug organizer=request.organizer.slug %}"
-                        method="post">
-                    {% csrf_token %}
-                    <input type="hidden" name="live" value="false">
+                </p>
+            </div>            
+            <form class="col-sm-12 col-lg-6 text-right"
+                    action="{% url "control:event.live" event=request.event.slug organizer=request.organizer.slug %}"
+                    method="post">
+                {% csrf_token %}
+                <input type="hidden" name="live" value="false">
 
-                    <button type="submit" class="btn btn-primary btn-lg btn-block">
-                        <span class="fa fa-power-off"></span>
-                        {% trans "Go offline" %}
-                    </button>
-                </form>
-            </div>
+                <button type="submit" class="btn btn-primary btn-lg">
+                    <span class="fa fa-power-off"></span>
+                    {% trans "Go offline" %}
+                </button>
+            </form>
         </div>
     </div>
 
@@ -34,22 +35,24 @@
             <h3 class="panel-title">{% trans "Cancel event" %}</h3>
         </div>
         <div class="row panel-body">
-            <div class="col-sm-12 col-md-9 nomargin-bottom">
+            <div class="col-sm-12 col-lg-6">
+                <p>
                 {% blocktrans trimmed %}
                     If you need to call off your event you want to cancel and refund all tickets, you can do so through
                     this option.
                 {% endblocktrans %}
+                </p>
             </div>
-            <div class="col-sm-12 col-md-3 text-center">
-                {% if "event:cancel" in request.eventpermset %}
-                    <a href="{% url "control:event.cancel" organizer=request.organizer.slug event=request.event.slug %}"
-                            class="btn btn-danger btn-block btn-lg">
-                        <span class="fa fa-ban"></span>
+            <div class="col-sm-12 col-lg-6 text-right">
+                <a href="{% url "control:event.cancel" organizer=request.organizer.slug event=request.event.slug %}"
+                        class="btn btn-danger btn-lg pull-right {% if "event:cancel" not in request.eventpermset %}disabled{% endif %}">
+                    <span class="fa fa-ban"></span>
+                    {% if "event:cancel" in request.eventpermset %}
                         {% trans "Cancel event" %}
-                    </a>
-                {% else %}
-                    {% trans "No permission" %}
-                {% endif %}
+                    {% else %}
+                        {% trans "No permission" %}
+                    {% endif %}
+                </a>
             </div>
         </div>
     </div>
@@ -59,15 +62,16 @@
             <h3 class="panel-title">{% trans "Delete personal data" %}</h3>
         </div>
         <div class="row panel-body">
-            <div class="col-sm-12 col-md-9 nomargin-bottom">
+            <div class="col-sm-12 col-lg-6">
+                <p>
                 {% blocktrans trimmed %}
                     You can remove personal data such as names and email addresses from your event and only retain the
                     financial information such as the number and type of tickets sold.
                 {% endblocktrans %}
+                </p>
             </div>
-            <div class="col-sm-12 col-md-3">
-                <a href="
-{% url "control:event.shredder.start" event=request.event.slug organizer=request.organizer.slug %}" class="btn btn-danger btn-lg btn-block">
+            <div class="col-sm-12 col-lg-6 text-right">
+                <a href="{% url "control:event.shredder.start" event=request.event.slug organizer=request.organizer.slug %}" class="btn btn-danger btn-lg">
                     <span class="fa fa-eraser"></span>
                     {% trans "Delete personal data" %}
                 </a>
@@ -80,15 +84,17 @@
             <h3 class="panel-title">{% trans "Delete event" %}</h3>
         </div>
         <div class="row panel-body">
-            <div class="col-sm-12 col-md-9 nomargin-bottom">
+            <div class="col-sm-12 col-lg-6">
+                <p>
                 {% blocktrans trimmed %}
                     You can delete your event completely only as long as it does not contain any undeletable data, such as
                     orders not performed in test mode.
                 {% endblocktrans %}
+                </p>
             </div>
-            <div class="col-sm-12 col-md-3">
+            <div class="col-sm-12 col-lg-6 text-right">
                 <a href="{% url "control:event.delete" organizer=request.organizer.slug event=request.event.slug %}"
-                        class="btn btn-danger btn-block btn-lg {% if not request.event.allow_delete %}disabled{% endif %}">
+                        class="btn btn-danger btn-lg {% if not request.event.allow_delete %}disabled{% endif %}">
                     <span class="fa fa-trash"></span>
                     {% trans "Delete event" %}
                 </a>

src/pretix/control/templates/pretixcontrol/order/approve.html

@@ -1,4 +1,5 @@
 {% extends "pretixcontrol/event/base.html" %}
+{% load eventsignal %}
 {% load i18n %}
 {% block title %}
     {% trans "Approve order" %}
@@ -7,6 +8,9 @@
     <h1>
         {% trans "Approve order" %}
     </h1>
+
+    {% eventsignal request.event "pretix.control.signals.order_approve_info" order=order request=request %}
+
     <p>{% blocktrans trimmed %}
         Do you really want to approve this order?
     {% endblocktrans %}</p>

src/pretix/control/templates/pretixcontrol/organizers/edit.html

@@ -222,6 +222,7 @@
                     <fieldset>
                         <legend>{% trans "Reusable media" %}</legend>
                         {% bootstrap_field sform.reusable_media_active layout="control" %}
+                        {% bootstrap_field sform.reusable_media_usage_enforced layout="control" %}
                         <div data-display-dependency="#{{ sform.reusable_media_active.id_for_label }}">
 
                             <div class="panel panel-default">

src/pretix/control/templates/pretixcontrol/organizers/reusable_media.html

@@ -58,8 +58,8 @@
                         <a href="?{% url_replace request 'ordering' 'identifier' %}"><i class="fa fa-caret-up"></i></a>
                     </th>
                     <th>{% trans "Media type" context "reusable_media" %}
-                        <a href="?{% url_replace request 'ordering' '-email' %}"><i class="fa fa-caret-down"></i></a>
-                        <a href="?{% url_replace request 'ordering' 'email' %}"><i class="fa fa-caret-up"></i></a></th>
+                        <a href="?{% url_replace request 'ordering' '-type' %}"><i class="fa fa-caret-down"></i></a>
+                        <a href="?{% url_replace request 'ordering' 'type' %}"><i class="fa fa-caret-up"></i></a></th>
                     <th>{% trans "Connections" context "reusable_media" %}</th>
                     <th></th>
                 </tr>
@@ -90,13 +90,13 @@
                                     {% endif %}
                                 </span>
                             {% endif %}
-                            {% if m.linked_orderposition %}
+                            {% for op in m.linked_orderpositions.all %}
                                 <span class="helper-display-block">
                                     <span class="fa fa-ticket fa-fw"></span>
-                                    <a href="{% url "control:event.order" event=m.linked_orderposition.order.event.slug organizer=request.organizer.slug code=m.linked_orderposition.order.code %}">
-                                        {{ m.linked_orderposition.order.code }}</a>-{{ m.linked_orderposition.positionid }}
+                                    <a href="{% url "control:event.order" event=op.order.event.slug organizer=request.organizer.slug code=op.order.code %}">
+                                        {{ op.order.code }}</a>-{{ op.positionid }}
                                 </span>
-                            {% endif %}
+                            {% endfor %}
                             {% if m.linked_giftcard %}
                                 <span class="helper-display-block">
                                     <span class="fa fa-credit-card fa-fw"></span>

src/pretix/control/templates/pretixcontrol/organizers/reusable_medium.html

@@ -26,7 +26,19 @@
                         <dt>{% trans "Media type" context "reusable_media" %}</dt>
                         <dd>{{ medium.get_type_display }}</dd>
                         <dt>{% trans "Identifier" context "reusable_media" %}</dt>
-                        <dd><code>{{ medium.identifier }}</code></dd>
+                        <dd>
+                            <code id="medium_identifier">{{ medium.identifier }}</code>
+                            <button type="button" class="btn btn-default btn-xs btn-clipboard js-only" data-clipboard-target="#medium_identifier">
+                                <i class="fa fa-clipboard" aria-hidden="true"></i>
+                                <span class="sr-only">{% trans "Copy to clipboard" %}</span>
+                            </button>
+                            {% if medium.type == "barcode" %}
+                            <button type="button" class="btn btn-default btn-xs js-only" data-toggle="qrcode" data-qrcode="{{ medium.identifier }}">
+                                <i class="fa fa-qrcode" aria-hidden="true"></i>
+                                <span class="sr-only">{% trans "Create QR code" %}</span>
+                            </button>
+                            {% endif %}
+                        </dd>
                         <dt>{% trans "Status" %}</dt>
                         <dd>
                             {% if not medium.active %}
@@ -41,34 +53,34 @@
                         <dd>
                             {% if medium.customer %}
                                 <span class="helper-display-block">
-                                <span class="fa fa-user fa-fw"></span>
-                                {% if "organizer.customers:read" in request.orgapermset %}
-                                    <a href="{% url "control:organizer.customer" organizer=request.organizer.slug customer=medium.customer.identifier %}">
+                                    <span class="fa fa-user fa-fw"></span>
+                                    {% if "organizer.customers:read" in request.orgapermset %}
+                                        <a href="{% url "control:organizer.customer" organizer=request.organizer.slug customer=medium.customer.identifier %}">
+                                            {{ medium.customer }}
+                                        </a>
+                                    {% else %}
                                         {{ medium.customer }}
-                                    </a>
-                                {% else %}
-                                    {{ medium.customer }}
-                                {% endif %}
-                            </span>
+                                    {% endif %}
+                                </span>
                             {% endif %}
-                            {% if medium.linked_orderposition %}
+                            {% for op in medium.linked_orderpositions.all %}
                                 <span class="helper-display-block">
-                                <span class="fa fa-ticket fa-fw"></span>
-                                <a href="{% url "control:event.order" event=medium.linked_orderposition.order.event.slug organizer=request.organizer.slug code=medium.linked_orderposition.order.code %}">
-                                    {{ medium.linked_orderposition.order.code }}</a>-{{ medium.linked_orderposition.positionid }}
-                            </span>
-                            {% endif %}
+                                    <span class="fa fa-ticket fa-fw"></span>
+                                    <a href="{% url "control:event.order" event=op.order.event.slug organizer=request.organizer.slug code=op.order.code %}">
+                                        {{ op.order.code }}</a>-{{ op.positionid }}
+                                </span>
+                            {% endfor %}
                             {% if medium.linked_giftcard %}
                                 <span class="helper-display-block">
-                                <span class="fa fa-credit-card fa-fw"></span>
-                                {% if "organizer.giftcards:read" in request.orgapermset %}
-                                    <a href="{% url "control:organizer.giftcard" organizer=request.organizer.slug giftcard=medium.linked_giftcard.id %}">
-                                        {{ medium.linked_giftcard.secret }}
-                                    </a>
-                                {% else %}
-                                    {{ medium.linked_giftcard.secret|slice:":3" }}…
-                                {% endif %}
-                            </span>
+                                    <span class="fa fa-credit-card fa-fw"></span>
+                                    {% if "organizer.giftcards:read" in request.orgapermset %}
+                                        <a href="{% url "control:organizer.giftcard" organizer=request.organizer.slug giftcard=medium.linked_giftcard.id %}">
+                                            {{ medium.linked_giftcard.secret }}
+                                        </a>
+                                    {% else %}
+                                        {{ medium.linked_giftcard.secret|slice:":3" }}…
+                                    {% endif %}
+                                </span>
                             {% endif %}
                         </dd>
                         {% if medium.notes %}

src/pretix/control/templates/pretixcontrol/organizers/team_edit.html

@@ -2,6 +2,7 @@
 {% load i18n %}
 {% load bootstrap3 %}
 {% load getitem %}
+{% load icon %}
 {% block inner %}
     {% if team %}
         <h1>{% trans "Team:" %} {{ team.name }}</h1>
@@ -25,6 +26,18 @@
             <legend>{% trans "Organizer permissions" %}</legend>
             {% bootstrap_field form.all_organizer_permissions layout="control" %}
             <div class="team-permission-groups col-md-9 col-md-offset-3" data-display-dependency="#id_all_organizer_permissions" data-inverse>
+                <p class="text-muted">
+                    {% icon "info-circle" %}
+                    {% blocktrans trimmed %}
+                        Even if a team has no access to a certain category of data, they might still be able to see
+                        parts of this data when it is linked to data they can see.
+                    {% endblocktrans %}
+                    {% blocktrans trimmed %}
+                        For example, someone with access to customer accounts will be able to see some information
+                        about gift cards linked to a customer account, even if they generally can't see gift cards
+                        directly.
+                    {% endblocktrans %}
+                </p>
                 {% for f in form.organizer_field_names %}
                     {% bootstrap_field form|getitem:f layout="control" %}
                 {% endfor %}
@@ -37,6 +50,17 @@
             {% bootstrap_field form.limit_events layout="control" %}
             {% bootstrap_field form.all_event_permissions layout="control" %}
             <div class="team-permission-groups col-md-9 col-md-offset-3" data-display-dependency="#id_all_event_permissions" data-inverse>
+                <p class="text-muted">
+                    {% icon "info-circle" %}
+                    {% blocktrans trimmed %}
+                        Even if a team has no access to a certain category of data, they might still be able to see
+                        parts of this data when it is linked to data they can see.
+                    {% endblocktrans %}
+                    {% blocktrans trimmed %}
+                        For example, someone with access to orders will be able to see some information about
+                        vouchers used to create an order, even if they generally can't see vouchers directly.
+                    {% endblocktrans %}
+                </p>
                 {% for f in form.event_field_names %}
                     {% bootstrap_field form|getitem:f layout="control" %}
                 {% endfor %}

src/pretix/control/templates/pretixcontrol/subevents/detail.html

@@ -4,290 +4,306 @@
 {% load formset_tags %}
 {% load eventsignal %}
 {% load static %}
-{% block title %}{% trans "Date" context "subevent" %}{% endblock %}
+{% load money %}
+{% load icon %}
+{% block title %}{% blocktrans trimmed with name=subevent.name context "subevent" %}Date: {{ name }}
+{% endblocktrans %}{% endblock %}
 {% block content %}
-    {% if not subevent.pk %}
-        <h1>{% trans "Create date" context "subevent" %}</h1>
-    {% else %}
-        <h1>{% trans "Date" context "subevent" %}</h1>
-    {% endif %}
-    <form action="" method="post" class="form-horizontal" enctype="multipart/form-data">
-        {% csrf_token %}
-        {% bootstrap_form_errors form %}
-        {% for f in itemvar_forms %}
-            {% bootstrap_form_errors f %}
-        {% endfor %}
-        <div class="row">
-            <div class="col-xs-12 {% if subevent.pk %}col-lg-10{% endif %}">
-                <fieldset>
-                    <legend>{% trans "General information" %}</legend>
-                    {% bootstrap_field form.name layout="control" %}
-                    {% bootstrap_field form.active layout="control" %}
-                    {% bootstrap_field form.date_from layout="control" %}
-                    {% bootstrap_field form.date_to layout="control" %}
-                    {% include "pretixcontrol/event/fragment_geodata.html" %}
-                    {% bootstrap_field form.date_admission layout="control" %}
-                    {% bootstrap_field form.frontpage_text layout="control" %}
-                    {% bootstrap_field form.is_public layout="control" %}
-                    {% bootstrap_field form.comment layout="control" %}
-                    {% if meta_forms %}
-                        <div class="form-group metadata-group">
-                            <label class="col-md-3 control-label">{% trans "Meta data" %}</label>
-                            <div class="col-md-9">
-                                {% for form in meta_forms %}
-                                    <div class="row">
-                                        <div class="col-md-4">
-                                            <label for="{{ form.value.id_for_label }}">
-                                                {{ form.property.name }}
-                                            </label>
-                                        </div>
-                                        <div class="col-md-8">
-                                            {% bootstrap_form form layout="inline" error_types="all" %}
-                                        </div>
-                                    </div>
-                                {% endfor %}
-                            </div>
-                        </div>
+    <h1>
+        {% blocktrans trimmed with name=subevent.name context "subevent" %}Date: {{ name }}{% endblocktrans %}
+        {% if 'event.subevents:write' in request.eventpermset %}
+            <a href="{% url "control:event.subevent.edit" event=request.event.slug organizer=request.event.organizer.slug subevent=subevent.pk %}"
+               class="btn btn-default">
+                <span class="fa fa-edit"></span>
+                {% trans "Edit" %}
+            </a>
+        {% endif %}
+    </h1>
+    <div class="row">
+        <div class="{% if "event.orders:read" in request.eventpermset %}col-md-5{% else %}col-md-10{% endif %} col-xs-12">
+            <fieldset>
+                <legend>{% trans "General information" %}</legend>
+                <dl class="dl-horizontal">
+                    <dt>{% trans "Name" %}</dt>
+                    <dd>{{ subevent.name }}</dd>
+                    <dt>{% trans "ID" %}</dt>
+                    <dd>#{{ subevent.pk }}</dd>
+                    <dt>{% trans "Status" %}</dt>
+                    <dd>
+                        {% if not subevent.active %}
+                            <span class="label label-danger">{% trans "Disabled" %}</span>
+                        {% elif subevent.presale_has_ended %}
+                            <span class="label label-warning">{% trans "Presale over" %}</span>
+                        {% elif not subevent.presale_is_running %}
+                            <span class="label label-warning">{% trans "Presale not started" %}</span>
+                        {% else %}
+                            <span class="label label-success">{% trans "On sale" %}</span>
+                        {% endif %}
+                    </dd>
+                    <dt>{% trans "Event start time" %}</dt>
+                    <dd>{{ subevent.date_from|date:"SHORT_DATETIME_FORMAT" }}</dd>
+                    <dt>{% trans "Event end time" %}</dt>
+                    <dd>{{ subevent.date_to|date:"SHORT_DATETIME_FORMAT" }}</dd>
+                    {% if subevent.date_admission %}
+                        <dt>{% trans "Admission time" %}</dt>
+                        <dd>{{ subevent.date_admission|date:"SHORT_DATETIME_FORMAT" }}</dd>
                     {% endif %}
-                </fieldset>
-                <fieldset>
-                    <legend>{% trans "Timeline" %}</legend>
-                    {% bootstrap_field form.presale_start layout="control" %}
-                    {% bootstrap_field form.presale_end layout="control" %}
-                </fieldset>
-                <fieldset>
-                    <legend>{% trans "Quotas" %}</legend>
-                    <div class="formset" data-formset data-formset-prefix="{{ formset.prefix }}">
-                        {{ formset.management_form }}
-                        {% bootstrap_formset_errors formset %}
-                        <div data-formset-body>
-                            {% for form in formset %}
-                                <div class="panel panel-default" data-formset-form>
-                                    <div class="sr-only">
-                                        {{ form.id }}
-                                        {% bootstrap_field form.DELETE form_group_class="" layout="inline" %}
-                                    </div>
-                                    <div class="panel-heading">
-                                        <h4 class="panel-title">
-                                            <div class="row">
-                                                <div class="col-md-10">
-                                                    {% bootstrap_field form.name layout='inline' form_group_class="" %}
-                                                </div>
-                                                <div class="col-md-2 text-right flip">
-                                                    <button type="button" class="btn btn-danger" data-formset-delete-button>
-                                                        <i class="fa fa-trash"></i></button>
-                                                </div>
-                                            </div>
-                                        </h4>
-                                    </div>
-                                    <div class="panel-body form-horizontal">
-                                        {% bootstrap_form_errors form %}
-                                        {% bootstrap_field form.size layout="control" %}
-                                        {% bootstrap_field form.itemvars layout="control" %}
-                                        {% bootstrap_field form.release_after_exit layout="control" %}
-                                        {% bootstrap_field form.ignore_for_event_availability layout="control" %}
-                                    </div>
-                                </div>
-                            {% endfor %}
-                        </div>
-                        <script type="form-template" data-formset-empty-form>
-                            {% escapescript %}
-                                <div class="panel panel-default" data-formset-form>
-                                    <div class="sr-only">
-                                        {{ formset.empty_form.id }}
-                                        {% bootstrap_field formset.empty_form.DELETE form_group_class="" layout="inline" %}
-                                    </div>
-                                    <div class="panel-heading">
-                                        <h4 class="panel-title">
-                                            <div class="row">
-                                                <div class="col-md-10">
-                                                    {% bootstrap_field formset.empty_form.name layout='inline' form_group_class="" %}
-                                                </div>
-                                                <div class="col-md-2 text-right flip">
-                                                    <button type="button" class="btn btn-danger" data-formset-delete-button>
-                                                        <i class="fa fa-trash"></i></button>
-                                                </div>
-                                            </div>
-                                        </h4>
-                                    </div>
-                                    <div class="panel-body form-horizontal">
-                                        {% bootstrap_field formset.empty_form.size layout="control" %}
-                                        {% bootstrap_field formset.empty_form.itemvars layout="control" %}
-                                        {% bootstrap_field formset.empty_form.release_after_exit layout="control" %}
-                                        {% bootstrap_field formset.empty_form.ignore_for_event_availability layout="control" %}
-                                    </div>
-                                </div>
-                            {% endescapescript %}
-                        </script>
-                        <p>
-                            <button type="button" class="btn btn-default" data-formset-add>
-                                <i class="fa fa-plus"></i> {% trans "Add a new quota" %}</button>
-                        </p>
-                </fieldset>
-                <fieldset>
-                    <legend>{% trans "Product settings" %}</legend>
-                    <p class="text-muted">
-                        {% trans "These settings are optional, if you leave them empty, the default values from the product settings will be used." %}
-                    </p>
-                    {% for f in itemvar_forms %}
-                        <div data-itemvar="{{ f.item.id }}{% if f.variation %}-{{ f.variation.id }}{% endif %}">
-                            {% bootstrap_form_errors f %}
-                            <div class="form-group subevent-itemvar-group">
-                                <label class="col-md-3 control-label" for="id_{{ f.prefix }}-price">
-                                    {% if f.variation %}{{ f.item }} – {{ f.variation }}{% else %}{{ f.item }}{% endif %}
-                                </label>
-                                <div class="col-md-4">
-                                    <label for="{{ f.price.id_for_label }}" class="text-muted">{% trans "Price" %}</label><br>
-                                    {% bootstrap_field f.price addon_after=request.event.currency form_group_class="" layout="inline" %}
-                                </div>
-                                <div class="col-md-4">
-                                    <br>
-                                    {% bootstrap_field f.disabled layout="inline" form_group_class="" %}
-                                </div>
-                            </div>
-                            <div class="form-group subevent-itemvar-group">
-                                <div class="col-md-4 col-md-offset-3">
-                                    <label for="{{ f.available_from.id_for_label }}" class="text-muted">{% trans "Available from" %}</label>
-                                    {% include "pretixcontrol/subevents/fragment_unavail_mode_indicator.html" with mode=f.available_from_mode %}<br>
-                                    {% bootstrap_field f.available_from form_group_class="foo" layout="inline" %}
-                                </div>
-                                <div class="col-md-4">
-                                    <label for="{{ f.available_until.id_for_label }}" class="text-muted">{% trans "Available until" %}</label>
-                                    {% include "pretixcontrol/subevents/fragment_unavail_mode_indicator.html" with mode=f.available_until_mode %}<br>
-                                    {% bootstrap_field f.available_until form_group_class="" layout="inline" %}
-                                </div>
-                            </div>
-                        </div>
+                    {% if subevent.presale_start %}
+                        <dt>{% trans "Start of presale" %}</dt>
+                        <dd>{{ subevent.presale_start|date:"SHORT_DATETIME_FORMAT" }}</dd>
+                    {% endif %}
+                    {% if subevent.presale_end %}
+                        <dt>{% trans "End of presale" %}</dt>
+                        <dd>{{ subevent.presale_end|date:"SHORT_DATETIME_FORMAT" }}</dd>
+                    {% endif %}
+                    {% if subevent.location %}
+                        <dt>{% trans "Location" %}</dt>
+                        <dd>{{ subevent.location|linebreaksbr }}</dd>
+                    {% endif %}
+                    <dt>{% trans "Show in lists" %}</dt>
+                    <dd>{{ subevent.is_public|yesno }}</dd>
+                    {% for k, v in subevent.meta_data.items %}
+                        <dt>{{ k }}</dt>
+                        <dd>{{ v }}</dd>
                     {% endfor %}
-                </fieldset>
+                    {% if subevent.comment %}
+                        <dt>{% trans "Internal comment" %}</dt>
+                        <dd>{{ subevent.comment|linebreaksbr }}</dd>
+                    {% endif %}
+                </dl>
+            </fieldset>
+            <fieldset>
+                <legend>{% trans "Quotas" %}</legend>
+                <div class="table-responsive">
+                    <table class="table table-hover table-quotas">
+                        <thead>
+                        <tr>
+                            <th>{% trans "Quota name" %}</th>
+                            <th>{% trans "Products" %}</th>
+                            <th>{% trans "Total capacity" %}</th>
+                            <th>{% trans "Capacity left" %}</th>
+                            <th class="action-col-2"></th>
+                        </tr>
+                        </thead>
+                        <tbody>
+                        {% for q in quotas %}
+                            <tr>
+                                <td>
+                                    <strong><a
+                                            href="{% url "control:event.items.quotas.show" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}">{{ q.name }}</a></strong>
+                                    {% if q.ignore_for_event_availability %}
+                                        <span class="fa fa-eye-slash text-muted" data-toggle="tooltip"
+                                              title="{% trans "Ignore this quota when determining event availability" %}"></span>
+                                    {% endif %}
+                                </td>
+                                <td>
+                                    <ul>
+                                        {% for item in q.cached_items %}
+                                            {% if not item.has_variations %}
+                                                <li>
+                                                    <a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=item.id %}">{{ item }}</a>
+                                                </li>
+                                            {% endif %}
+                                        {% endfor %}
+                                        {% for v in q.variations.all %}
+                                            <li>
+                                                <a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=v.item.id %}#tab-0-3-open">
+                                                    {{ v.item }} – {{ v }}</a></li>
+                                        {% endfor %}
+                                    </ul>
+                                </td>
+                                <td>{% if q.size == None %}Unlimited{% else %}{{ q.size }}{% endif %}</td>
+                                <td>{% include "pretixcontrol/items/fragment_quota_availability.html" with availability=q.cached_avail closed=q.closed %}</td>
+                                <td class="text-right flip">
+                                    {% if 'event.items:write' in request.eventpermset %}
+                                        <a href="{% url "control:event.items.quotas.edit" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}"
+                                           class="btn btn-default btn-sm"><i class="fa fa-edit"></i></a>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                        {% endfor %}
+                        </tbody>
+                    </table>
+                </div>
+            </fieldset>
+            {% if checkinlists %}
                 <fieldset>
                     <legend>{% trans "Check-in lists" %}</legend>
-                    <p class="help-block">
-                        {% blocktrans trimmed %}
-                            You can choose to either add one or more check-in lists for every date in your series individually,
-                            or use just one check-in list for all your dates and limit admission through check-in rules. Which
-                            approach is better depends on multiple factors, such as the number of dates in your series. For a
-                            series with one or less event date per day, individual lists are usually more helpful. If you
-                            use dates to represent many time slots on the same day, or even overlapping time slots, working with
-                            just one large check-in list will be easier.
-                        {% endblocktrans %}
-                    </p>
-                    <div class="formset" data-formset data-formset-prefix="{{ cl_formset.prefix }}">
-                        {{ cl_formset.management_form }}
-                        {% bootstrap_formset_errors cl_formset %}
-                        <div data-formset-body>
-                            {% for form in cl_formset %}
-                                <div class="panel panel-default" data-formset-form>
-                                    <div class="sr-only">
-                                        {{ form.id }}
-                                        {% bootstrap_field form.DELETE form_group_class="" layout="inline" %}
-                                    </div>
-                                    <div class="panel-heading">
-                                        <h4 class="panel-title">
-                                            <div class="row">
-                                                <div class="col-md-10">
-                                                    {% bootstrap_field form.name layout='inline' form_group_class="" %}
+                    <div class="table-responsive">
+                        <table class="table table-hover table-quotas">
+                            <thead>
+                            <tr>
+                                <th>{% trans "Name" %}</th>
+                                {% if "event.orders:read" in request.eventpermset %}
+                                    <th>{% trans "Checked in" %}</th>
+                                {% endif %}
+                                <th>{% trans "Products" %}</th>
+                                <th class="action-col-2"></th>
+                            </tr>
+                            </thead>
+                            <tbody>
+                            {% for cl in checkinlists %}
+                                <tr>
+                                    <td>
+                                        <strong><a
+                                                href="{% url "control:event.orders.checkinlists.show" organizer=request.event.organizer.slug event=request.event.slug list=cl.id %}">{{ cl.name }}</a></strong>
+                                    </td>
+                                    {% if "event.orders:read" in request.eventpermset %}
+                                        <td>
+                                            <div class="quotabox availability">
+                                                <div class="progress">
+                                                    <div class="progress-bar progress-bar-success progress-bar-{{ cl.percent }}">
+                                                    </div>
                                                 </div>
-                                                <div class="col-md-2 text-right flip">
-                                                    <button type="button" class="btn btn-danger" data-formset-delete-button>
-                                                        <i class="fa fa-trash"></i></button>
+                                                <div class="numbers">
+                                                    {{ cl.checkin_count|default_if_none:"0" }} /
+                                                    {{ cl.position_count|default_if_none:"0" }}
                                                 </div>
                                             </div>
-                                        </h4>
-                                    </div>
-                                    <div class="panel-body form-horizontal">
-                                        {% bootstrap_form_errors form %}
-                                        {% bootstrap_field form.include_pending layout="control" %}
-                                        {% bootstrap_field form.all_products layout="control" %}
-                                        {% bootstrap_field form.limit_products layout="control" %}
-                                        {% bootstrap_field form.allow_entry_after_exit layout="control" %}
-                                        {% if form.gates %}
-                                            {% bootstrap_field form.gates layout="control" %}
+                                        </td>
+                                    {% endif %}
+                                    <td>
+                                        {% if cl.all_products %}
+                                            <em>{% trans "All" %}</em>
+                                        {% else %}
+                                            <ul>
+                                                {% for item in cl.limit_products.all %}
+                                                    <li>
+                                                        <a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=item.id %}">{{ item }}</a>
+                                                    </li>
+                                                {% endfor %}
+                                            </ul>
                                         {% endif %}
-                                    </div>
-                                </div>
+                                    </td>
+                                    <td class="text-right flip">
+                                        {% if "event.orders:read" in request.eventpermset %}
+                                            <a href="{% url "control:event.orders.checkinlists.show" organizer=request.event.organizer.slug event=request.event.slug list=cl.id %}"
+                                               class="btn btn-default btn-sm"><i class="fa fa-eye"></i></a>
+                                        {% endif %}
+                                        {% if "event.settings.general:write" in request.eventpermset %}
+                                            <a href="{% url "control:event.orders.checkinlists.add" organizer=request.event.organizer.slug event=request.event.slug %}?copy_from={{ cl.id }}"
+                                               class="btn btn-sm btn-default" title="{% trans "Clone" %}"
+                                               data-toggle="tooltip">
+                                                <span class="fa fa-copy"></span>
+                                            </a>
+                                        {% endif %}
+                                    </td>
+                                </tr>
                             {% endfor %}
-                        </div>
-                        <script type="form-template" data-formset-empty-form>
-                            {% escapescript %}
-                                <div class="panel panel-default" data-formset-form>
-                                    <div class="sr-only">
-                                        {{ cl_formset.empty_form.id }}
-                                        {% bootstrap_field cl_formset.empty_form.DELETE form_group_class="" layout="inline" %}
-                                    </div>
-                                    <div class="panel-heading">
-                                        <h4 class="panel-title">
-                                            <div class="row">
-                                                <div class="col-md-10">
-                                                    {% bootstrap_field cl_formset.empty_form.name layout='inline' form_group_class="" %}
-                                                </div>
-                                                <div class="col-md-2 text-right flip">
-                                                    <button type="button" class="btn btn-danger" data-formset-delete-button>
-                                                        <i class="fa fa-trash"></i></button>
-                                                </div>
-                                            </div>
-                                        </h4>
-                                    </div>
-                                    <div class="panel-body form-horizontal">
-                                        {% bootstrap_field cl_formset.empty_form.include_pending layout="control" %}
-                                        {% bootstrap_field cl_formset.empty_form.all_products layout="control" %}
-                                        {% bootstrap_field cl_formset.empty_form.limit_products layout="control" %}
-                                        {% bootstrap_field cl_formset.empty_form.allow_entry_after_exit layout="control" %}
-                                        {% if cl_formset.empty_form.gates %}
-                                            {% bootstrap_field cl_formset.empty_form.gates layout="control" %}
-                                        {% endif %}
-                                    </div>
-                                </div>
-                            {% endescapescript %}
-                        </script>
-                        <p>
-                            <button type="button" class="btn btn-default" data-formset-add>
-                                <i class="fa fa-plus"></i> {% trans "Add a new check-in list" %}
-                            </button>
-                        </p>
+                            </tbody>
+                        </table>
                 </fieldset>
-                {% for f in plugin_forms %}
-                    {% if f.title %}
-                        <fieldset>
-                            <legend>{{ f.title }}</legend>
-                            {% if f.template %}
-                                {% include f.template with form=f %}
-                            {% else %}
-                                {% bootstrap_form f layout="control" %}
-                            {% endif %}
-                        </fieldset>
-                    {% endif %}
-                {% endfor %}
+            {% endif %}
+            {% eventsignal request.event "pretix.control.signals.subevent_detail_html" subevent=subevent %}
+        </div>
+        {% if "event.orders:read" in request.eventpermset %}
+            <div class="col-md-5 col-xs-12">
                 <fieldset>
-                    <legend>{% trans "Additional settings" %}</legend>
-                    {% for f in plugin_forms %}
-                        {% if not f.title %}
-                            {% if f.template %}
-                                {% include f.template with form=f %}
-                            {% else %}
-                                {% bootstrap_form f layout="control" %}
-                            {% endif %}
+                    <legend>
+                        {% trans "Orders" %}
+                        <span class="badge">
+                            {{ order_count }}
+                        </span>
+                    </legend>
+                    {% if order_count %}
+                        <div class="table-responsive">
+                            <table class="table table-condensed table-hover table-orders">
+                                <thead>
+                                <tr>
+                                    <th>{% trans "Order code" %}</th>
+                                    <th>{% trans "Details" %}</th>
+                                </tr>
+                                </thead>
+                                <tbody>
+                                {% for o in orders %}
+                                    <tr>
+                                        <td>
+                                            <strong>
+                                                <a href="{% url "control:event.order" event=request.event.slug organizer=request.event.organizer.slug code=o.code %}">
+                                                    {{ o.code }}
+                                                </a>
+                                            </strong>
+                                            <br>
+                                            {% if o.testmode %}
+                                                <span class="label label-warning">{% trans "TEST MODE" %}</span>
+                                            {% endif %}
+                                            {% if o.status == "p" and o.pcnt == 0 %}
+                                                {# Everything related to this subevent is canceled #}
+                                                <span class="label label-danger">
+                                                <span class="fa fa-times"></span>
+                                                {% trans "partially canceled" %}
+                                            </span>
+                                            {% else %}
+                                                {% include "pretixcontrol/orders/fragment_order_status.html" with order=o %}
+                                            {% endif %}
+                                        </td>
+                                        <td>
+                                            {% if "." in o.sales_channel.icon %}
+                                                <img src="{% static o.sales_channel.icon %}" class="fa-like-image"
+                                                     data-toggle="tooltip" title="{{ o.sales_channel.label }}">
+                                            {% else %}
+                                                <span class="fa fa-fw fa-{{ o.sales_channel.icon }} text-muted"
+                                                      data-toggle="tooltip" title="{{ o.sales_channel.label }}"></span>
+                                            {% endif %}
+                                            {{ o.datetime|date:"SHORT_DATETIME_FORMAT" }}
+                                            {% if o.email %}
+                                                <br>{% icon "envelope-o fa-fw text-muted" %}
+                                                {{ o.email|default_if_none:"" }}
+                                            {% endif %}
+                                            {% if o.invoice_address.name %}
+                                                <br>{% icon "user fa-fw text-muted" %} {{ o.invoice_address.name }}
+                                            {% endif %}
+                                            <br>{% icon "ticket text-muted fa-fw" %} {{ o.pcnt }}
+                                            {% if o.comment %}
+                                                <br>
+                                                <span class="text-muted">
+                                                {{ o.comment|linebreaksbr }}
+                                            </span>
+                                            {% endif %}
+                                            {% if o.custom_followup_due %}
+                                                <br>
+                                                <span class="label label-danger">{% blocktrans trimmed with date=o.custom_followup_at|date:"SHORT_DATE_FORMAT" context "followup" %}
+                                                    TODO {{ date }}{% endblocktrans %}</span>
+                                            {% elif o.custom_followup_at %}
+                                                <br>
+                                                <span class="label label-default">{% blocktrans trimmed with date=o.custom_followup_at|date:"SHORT_DATE_FORMAT" context "followup" %}
+                                                    TODO {{ date }}{% endblocktrans %}</span>
+                                            {% endif %}
+                                        </td>
+                                    </tr>
+                                {% endfor %}
+                                </tbody>
+                            </table>
+                        </div>
+                        {% if order_count > 10 %}
+                            <p class="text-center">
+                                <a href="{% url "control:event.orders" organizer=request.organizer.slug event=request.event.slug %}?subevent={{ subevent.pk }}"
+                                   class="btn btn-default">
+                                    {% trans "View all" %}
+                                </a>
+                            </p>
                         {% endif %}
-                    {% endfor %}
+                    {% else %}
+                        <div class="empty-collection">
+                            <p>
+                                {% blocktrans trimmed %}
+                                    No orders found.
+                                {% endblocktrans %}
+                            </p>
+                        </div>
+                    {% endif %}
                 </fieldset>
             </div>
-            {% if subevent.pk %}
-                <div class="col-xs-12 col-lg-2">
-                    <div class="panel panel-default">
-                        <div class="panel-heading">
-                            <h3 class="panel-title">
-                                {% trans "Date history" context "subevent" %}
-                            </h3>
-                        </div>
-                        {% include "pretixcontrol/includes/logs.html" with obj=subevent %}
-                    </div>
+        {% endif %}
+        <div class="col-md-2 col-xs-12">
+            <div class="panel panel-default">
+                <div class="panel-heading">
+                    <h3 class="panel-title">
+                        {% trans "Date history" context "subevent" %}
+                    </h3>
                 </div>
-            {% endif %}
+                {% include "pretixcontrol/includes/logs.html" with obj=subevent %}
+            </div>
         </div>
-        <div class="form-group submit-group submit-group-sticky">
-            <button type="submit" class="btn btn-primary btn-save">
-                {% trans "Save" %}
-            </button>
-        </div>
-    </form>
+    </div>
 {% endblock %}

src/pretix/control/templates/pretixcontrol/subevents/edit.html

@@ -0,0 +1,296 @@
+{% extends "pretixcontrol/event/base.html" %}
+{% load i18n %}
+{% load bootstrap3 %}
+{% load formset_tags %}
+{% load eventsignal %}
+{% load static %}
+{% block title %}{% trans "Date" context "subevent" %}{% endblock %}
+{% block content %}
+    {% if not subevent.pk %}
+        <h1>{% trans "Create date" context "subevent" %}</h1>
+    {% else %}
+        <h1>{% trans "Date" context "subevent" %}</h1>
+    {% endif %}
+    <form action="" method="post" class="form-horizontal" enctype="multipart/form-data">
+        {% csrf_token %}
+        {% bootstrap_form_errors form %}
+        {% for f in itemvar_forms %}
+            {% bootstrap_form_errors f %}
+        {% endfor %}
+        <div class="row">
+            <div class="col-xs-12 {% if subevent.pk %}col-lg-10{% endif %}">
+                <fieldset>
+                    <legend>{% trans "General information" %}</legend>
+                    {% bootstrap_field form.name layout="control" %}
+                    {% bootstrap_field form.active layout="control" %}
+                    {% bootstrap_field form.date_from layout="control" %}
+                    {% bootstrap_field form.date_to layout="control" %}
+                    {% include "pretixcontrol/event/fragment_geodata.html" %}
+                    {% bootstrap_field form.date_admission layout="control" %}
+                    {% bootstrap_field form.frontpage_text layout="control" %}
+                    {% bootstrap_field form.is_public layout="control" %}
+                    {% bootstrap_field form.comment layout="control" %}
+                    {% if meta_forms %}
+                        <div class="form-group metadata-group">
+                            <label class="col-md-3 control-label">{% trans "Meta data" %}</label>
+                            <div class="col-md-9">
+                                {% for form in meta_forms %}
+                                    <div class="row">
+                                        <div class="col-md-4">
+                                            <label for="{{ form.value.id_for_label }}">
+                                                {{ form.property.name }}
+                                            </label>
+                                        </div>
+                                        <div class="col-md-8">
+                                            {% bootstrap_form form layout="inline" error_types="all" %}
+                                        </div>
+                                    </div>
+                                {% endfor %}
+                            </div>
+                        </div>
+                    {% endif %}
+                </fieldset>
+                <fieldset>
+                    <legend>{% trans "Timeline" %}</legend>
+                    {% bootstrap_field form.presale_start layout="control" %}
+                    {% bootstrap_field form.presale_end layout="control" %}
+                </fieldset>
+                <fieldset>
+                    <legend>{% trans "Quotas" %}</legend>
+                    <div class="formset" data-formset data-formset-prefix="{{ formset.prefix }}">
+                        {{ formset.management_form }}
+                        {% bootstrap_formset_errors formset %}
+                        <div data-formset-body>
+                            {% for form in formset %}
+                                <div class="panel panel-default" data-formset-form>
+                                    <div class="sr-only">
+                                        {{ form.id }}
+                                        {% bootstrap_field form.DELETE form_group_class="" layout="inline" %}
+                                    </div>
+                                    <div class="panel-heading">
+                                        <h4 class="panel-title">
+                                            <div class="row">
+                                                <div class="col-md-10">
+                                                    {% bootstrap_field form.name layout='inline' form_group_class="" %}
+                                                </div>
+                                                <div class="col-md-2 text-right flip">
+                                                    <button type="button" class="btn btn-danger" data-formset-delete-button>
+                                                        <i class="fa fa-trash"></i></button>
+                                                </div>
+                                            </div>
+                                        </h4>
+                                    </div>
+                                    <div class="panel-body form-horizontal">
+                                        {% bootstrap_form_errors form %}
+                                        {% bootstrap_field form.size layout="control" %}
+                                        {% bootstrap_field form.itemvars layout="control" %}
+                                        {% bootstrap_field form.release_after_exit layout="control" %}
+                                        {% bootstrap_field form.ignore_for_event_availability layout="control" %}
+                                    </div>
+                                </div>
+                            {% endfor %}
+                        </div>
+                        <script type="form-template" data-formset-empty-form>
+                            {% escapescript %}
+                                <div class="panel panel-default" data-formset-form>
+                                    <div class="sr-only">
+                                        {{ formset.empty_form.id }}
+                                        {% bootstrap_field formset.empty_form.DELETE form_group_class="" layout="inline" %}
+                                    </div>
+                                    <div class="panel-heading">
+                                        <h4 class="panel-title">
+                                            <div class="row">
+                                                <div class="col-md-10">
+                                                    {% bootstrap_field formset.empty_form.name layout='inline' form_group_class="" %}
+                                                </div>
+                                                <div class="col-md-2 text-right flip">
+                                                    <button type="button" class="btn btn-danger" data-formset-delete-button>
+                                                        <i class="fa fa-trash"></i></button>
+                                                </div>
+                                            </div>
+                                        </h4>
+                                    </div>
+                                    <div class="panel-body form-horizontal">
+                                        {% bootstrap_field formset.empty_form.size layout="control" %}
+                                        {% bootstrap_field formset.empty_form.itemvars layout="control" %}
+                                        {% bootstrap_field formset.empty_form.release_after_exit layout="control" %}
+                                        {% bootstrap_field formset.empty_form.ignore_for_event_availability layout="control" %}
+                                    </div>
+                                </div>
+                            {% endescapescript %}
+                        </script>
+                        <p>
+                            <button type="button" class="btn btn-default" data-formset-add>
+                                <i class="fa fa-plus"></i> {% trans "Add a new quota" %}</button>
+                        </p>
+                </fieldset>
+                <fieldset>
+                    <legend>{% trans "Product settings" %}</legend>
+                    <p class="text-muted">
+                        {% trans "These settings are optional, if you leave them empty, the default values from the product settings will be used." %}
+                    </p>
+                    {% for f in itemvar_forms %}
+                        <div data-itemvar="{{ f.item.id }}{% if f.variation %}-{{ f.variation.id }}{% endif %}">
+                            {% bootstrap_form_errors f %}
+                            <div class="form-group subevent-itemvar-group">
+                                <label class="col-md-3 control-label" for="id_{{ f.prefix }}-price">
+                                    {% if f.variation %}{{ f.item }} – {{ f.variation }}{% else %}{{ f.item }}{% endif %}
+                                </label>
+                                <div class="col-md-4">
+                                    <label for="{{ f.price.id_for_label }}" class="text-muted">{% trans "Price" %}</label><br>
+                                    {% bootstrap_field f.price addon_after=request.event.currency form_group_class="" layout="inline" %}
+                                </div>
+                                <div class="col-md-4">
+                                    <br>
+                                    {% bootstrap_field f.disabled layout="inline" form_group_class="" %}
+                                </div>
+                            </div>
+                            <div class="form-group subevent-itemvar-group">
+                                <div class="col-md-4 col-md-offset-3">
+                                    <label for="{{ f.available_from.id_for_label }}" class="text-muted">{% trans "Available from" %}</label>
+                                    {% include "pretixcontrol/subevents/fragment_unavail_mode_indicator.html" with mode=f.available_from_mode %}<br>
+                                    {% bootstrap_field f.available_from form_group_class="foo" layout="inline" %}
+                                </div>
+                                <div class="col-md-4">
+                                    <label for="{{ f.available_until.id_for_label }}" class="text-muted">{% trans "Available until" %}</label>
+                                    {% include "pretixcontrol/subevents/fragment_unavail_mode_indicator.html" with mode=f.available_until_mode %}<br>
+                                    {% bootstrap_field f.available_until form_group_class="" layout="inline" %}
+                                </div>
+                            </div>
+                        </div>
+                    {% endfor %}
+                </fieldset>
+                <fieldset>
+                    <legend>{% trans "Check-in lists" %}</legend>
+                    <p class="help-block">
+                        {% blocktrans trimmed %}
+                            You can choose to either add one or more check-in lists for every date in your series individually,
+                            or use just one check-in list for all your dates and limit admission through check-in rules. Which
+                            approach is better depends on multiple factors, such as the number of dates in your series. For a
+                            series with one or less event date per day, individual lists are usually more helpful. If you
+                            use dates to represent many time slots on the same day, or even overlapping time slots, working with
+                            just one large check-in list will be easier.
+                        {% endblocktrans %}
+                    </p>
+                    <div class="formset" data-formset data-formset-prefix="{{ cl_formset.prefix }}">
+                        {{ cl_formset.management_form }}
+                        {% bootstrap_formset_errors cl_formset %}
+                        <div data-formset-body>
+                            {% for form in cl_formset %}
+                                <div class="panel panel-default" data-formset-form>
+                                    <div class="sr-only">
+                                        {{ form.id }}
+                                        {% bootstrap_field form.DELETE form_group_class="" layout="inline" %}
+                                    </div>
+                                    <div class="panel-heading">
+                                        <h4 class="panel-title">
+                                            <div class="row">
+                                                <div class="col-md-10">
+                                                    {% bootstrap_field form.name layout='inline' form_group_class="" %}
+                                                </div>
+                                                <div class="col-md-2 text-right flip">
+                                                    <button type="button" class="btn btn-danger" data-formset-delete-button>
+                                                        <i class="fa fa-trash"></i></button>
+                                                </div>
+                                            </div>
+                                        </h4>
+                                    </div>
+                                    <div class="panel-body form-horizontal">
+                                        {% bootstrap_form_errors form %}
+                                        {% bootstrap_field form.include_pending layout="control" %}
+                                        {% bootstrap_field form.all_products layout="control" %}
+                                        {% bootstrap_field form.limit_products layout="control" %}
+                                        {% bootstrap_field form.allow_entry_after_exit layout="control" %}
+                                        {% if form.gates %}
+                                            {% bootstrap_field form.gates layout="control" %}
+                                        {% endif %}
+                                    </div>
+                                </div>
+                            {% endfor %}
+                        </div>
+                        <script type="form-template" data-formset-empty-form>
+                            {% escapescript %}
+                                <div class="panel panel-default" data-formset-form>
+                                    <div class="sr-only">
+                                        {{ cl_formset.empty_form.id }}
+                                        {% bootstrap_field cl_formset.empty_form.DELETE form_group_class="" layout="inline" %}
+                                    </div>
+                                    <div class="panel-heading">
+                                        <h4 class="panel-title">
+                                            <div class="row">
+                                                <div class="col-md-10">
+                                                    {% bootstrap_field cl_formset.empty_form.name layout='inline' form_group_class="" %}
+                                                </div>
+                                                <div class="col-md-2 text-right flip">
+                                                    <button type="button" class="btn btn-danger" data-formset-delete-button>
+                                                        <i class="fa fa-trash"></i></button>
+                                                </div>
+                                            </div>
+                                        </h4>
+                                    </div>
+                                    <div class="panel-body form-horizontal">
+                                        {% bootstrap_field cl_formset.empty_form.include_pending layout="control" %}
+                                        {% bootstrap_field cl_formset.empty_form.all_products layout="control" %}
+                                        {% bootstrap_field cl_formset.empty_form.limit_products layout="control" %}
+                                        {% bootstrap_field cl_formset.empty_form.allow_entry_after_exit layout="control" %}
+                                        {% if cl_formset.empty_form.gates %}
+                                            {% bootstrap_field cl_formset.empty_form.gates layout="control" %}
+                                        {% endif %}
+                                    </div>
+                                </div>
+                            {% endescapescript %}
+                        </script>
+                        <p>
+                            <button type="button" class="btn btn-default" data-formset-add>
+                                <i class="fa fa-plus"></i> {% trans "Add a new check-in list" %}
+                            </button>
+                        </p>
+                </fieldset>
+                {% for f in plugin_forms %}
+                    {% if f.title %}
+                        <fieldset>
+                            <legend>{{ f.title }}</legend>
+                            {% if f.template %}
+                                {% include f.template with form=f %}
+                            {% else %}
+                                {% bootstrap_form f layout="control" %}
+                            {% endif %}
+                        </fieldset>
+                    {% endif %}
+                {% endfor %}
+                <fieldset>
+                    <legend>{% trans "Additional settings" %}</legend>
+                    {% for f in plugin_forms %}
+                        {% if not f.title %}
+                            {% if f.template %}
+                                {% include f.template with form=f %}
+                            {% else %}
+                                {% bootstrap_form f layout="control" %}
+                            {% endif %}
+                        {% endif %}
+                    {% endfor %}
+                </fieldset>
+            </div>
+            {% if subevent.pk %}
+                <div class="col-xs-12 col-lg-2">
+                    <div class="panel panel-default">
+                        <div class="panel-heading">
+                            <h3 class="panel-title">
+                                {% trans "Date history" context "subevent" %}
+                            </h3>
+                        </div>
+                        {% include "pretixcontrol/includes/logs.html" with obj=subevent %}
+                    </div>
+                </div>
+            {% endif %}
+        </div>
+        <div class="form-group submit-group submit-group-sticky">
+            <a href="{{ next_url }}" class="btn btn-default btn-cancel">
+                {% trans "Cancel" %}
+            </a>
+            <button type="submit" class="btn btn-primary btn-save">
+                {% trans "Save" %}
+            </button>
+        </div>
+    </form>
+{% endblock %}

src/pretix/control/templates/pretixcontrol/subevents/index.html

@@ -133,7 +133,7 @@
                                 </td>
                             {% endif %}
                             <td>
-                                <strong><a href="{% url "control:event.subevent" organizer=request.event.organizer.slug event=request.event.slug subevent=s.id %}?returnto={{ request.GET.urlencode|urlencode }}">
+                                <strong><a href="{% url "control:event.subevent" organizer=request.event.organizer.slug event=request.event.slug subevent=s.id %}">
                                     {{ s.name }}</a></strong><br>
                                 <small class="text-muted">
                                     #{{ s.pk }}
@@ -182,7 +182,7 @@
                                 {% endif %}
 
                                 {% if "event.subevents:write" in request.eventpermset %}
-                                    <a href="{% url "control:event.subevent" organizer=request.event.organizer.slug event=request.event.slug subevent=s.id %}?returnto={{ request.GET.urlencode|urlencode }}" class="btn btn-default btn-sm"><i class="fa fa-edit"></i></a>
+                                    <a href="{% url "control:event.subevent.edit" organizer=request.event.organizer.slug event=request.event.slug subevent=s.id %}?next={{ request.get_full_path|urlencode }}" class="btn btn-default btn-sm"><i class="fa fa-edit"></i></a>
                                     <div class="btn-group {% if forloop.revcounter0 < 2 %}dropup{% endif %}">
                                         <button type="button" class="btn btn-default btn-sm dropdown-toggle"
                                                 data-toggle="dropdown">
@@ -201,7 +201,7 @@
                                             </li>
                                         </ul>
                                     </div>
-                                    <a href="{% url "control:event.subevent.delete" organizer=request.event.organizer.slug event=request.event.slug subevent=s.id %}?returnto={{ request.GET.urlencode|urlencode }}" class="btn btn-danger btn-sm"><i class="fa fa-trash"></i></a>
+                                    <a href="{% url "control:event.subevent.delete" organizer=request.event.organizer.slug event=request.event.slug subevent=s.id %}?next={{ request.get_full_path|urlencode }}" class="btn btn-danger btn-sm"><i class="fa fa-trash"></i></a>
                                 {% endif %}
                             </td>
                         </tr>

src/pretix/control/urls.py

@@ -308,7 +308,8 @@ urlpatterns = [
         re_path(r'^pdf/editor/(?P<filename>[^/]+).pdf$', pdf.PdfView.as_view(), name='pdf.background'),
         re_path(r'^subevents/$', subevents.SubEventList.as_view(), name='event.subevents'),
         re_path(r'^subevents/select2$', typeahead.subevent_select2, name='event.subevents.select2'),
-        re_path(r'^subevents/(?P<subevent>\d+)/$', subevents.SubEventUpdate.as_view(), name='event.subevent'),
+        re_path(r'^subevents/(?P<subevent>\d+)/$', subevents.SubEventDetail.as_view(), name='event.subevent'),
+        re_path(r'^subevents/(?P<subevent>\d+)/edit$', subevents.SubEventUpdate.as_view(), name='event.subevent.edit'),
         re_path(r'^subevents/(?P<subevent>\d+)/delete$', subevents.SubEventDelete.as_view(),
                 name='event.subevent.delete'),
         re_path(r'^subevents/add$', subevents.SubEventCreate.as_view(), name='event.subevents.add'),

src/pretix/control/views/checkin.py

@@ -50,7 +50,7 @@ from i18nfield.strings import LazyI18nString
 
 from pretix.api.views.checkin import _redeem_process
 from pretix.base.media import MEDIA_TYPES
-from pretix.base.models import Checkin, LogEntry, Order, OrderPosition
+from pretix.base.models import Checkin, Item, LogEntry, Order, OrderPosition
 from pretix.base.models.checkin import CheckinList
 from pretix.base.models.orders import PrintLog
 from pretix.base.permissions import AnyPermissionOf
@@ -401,13 +401,14 @@ class CheckinListUpdate(EventPermissionRequiredMixin, UpdateView):
                 {
                     'id': i.pk,
                     'name': str(i),
+                    'active': i.active,
                     'variations': [
                         {
                             'id': v.pk,
                             'name': str(v.value)
                         } for v in i.variations.all()
                     ]
-                } for i in self.request.event.items.filter(active=True).prefetch_related('variations')
+                } for i in self.request.event.items.prefetch_related('variations')
             ],
             **super().get_context_data(),
         }
@@ -532,6 +533,8 @@ class CheckInListSimulator(EventPermissionRequiredMixin, FormView):
             checkinlist=self.list,
             result=self.result,
             reason_labels=dict(Checkin.REASONS),
+            media_policies=dict(Item.MEDIA_POLICIES),
+            media_types=dict(MEDIA_TYPES),
         )
 
     def form_valid(self, form):

src/pretix/control/views/discounts.py

@@ -44,7 +44,7 @@ from pretix.control.permissions import (
 from pretix.helpers.models import modelcopy
 
 from ...helpers.compat import CompatDeleteView
-from . import CreateView, PaginationMixin, UpdateView
+from . import CreateView, UpdateView
 
 
 class DiscountDelete(EventPermissionRequiredMixin, CompatDeleteView):
@@ -183,7 +183,7 @@ class DiscountCreate(EventPermissionRequiredMixin, CreateView):
         return super().form_invalid(form)
 
 
-class DiscountList(PaginationMixin, ListView):
+class DiscountList(ListView):
     model = Discount
     context_object_name = 'discounts'
     template_name = 'pretixcontrol/items/discounts.html'

src/pretix/control/views/item.py

@@ -335,7 +335,7 @@ class CategoryCreate(EventPermissionRequiredMixin, CreateView):
         return super().form_invalid(form)
 
 
-class CategoryList(PaginationMixin, ListView):
+class CategoryList(ListView):
     model = ItemCategory
     context_object_name = 'categories'
     template_name = 'pretixcontrol/items/categories.html'

src/pretix/control/views/orders.py

@@ -396,6 +396,7 @@ class OrderDeleteBulkActionView(BaseOrderBulkActionView):
 
     def execute_single(self, instance, form: forms.Form):
         instance.gracefully_delete(user=self.request.user)
+        return True
 
 
 class OrderList(OrderSearchMixin, EventPermissionRequiredMixin, PaginationMixin, ListView):

src/pretix/control/views/organizer.py

@@ -3384,8 +3384,10 @@ class ReusableMediaListView(OrganizerDetailViewMixin, OrganizerPermissionRequire
 
     def get_queryset(self):
         qs = self.request.organizer.reusable_media.select_related(
-            'customer', 'linked_orderposition', 'linked_orderposition__order', 'linked_orderposition__order__event',
-            'linked_giftcard'
+            'customer',
+            'linked_giftcard',
+        ).prefetch_related(
+            Prefetch('linked_orderpositions', queryset=OrderPosition.objects.select_related("order", "order__event"))
         )
         if self.filter_form.is_valid():
             qs = self.filter_form.filter_qs(qs)
@@ -3433,10 +3435,14 @@ class ReusableMediumCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequ
     @transaction.atomic
     def form_valid(self, form):
         r = super().form_valid(form)
-        form.instance.log_action('pretix.reusable_medium.created', user=self.request.user, data={
+
+        data = {
             k: getattr(form.instance, k)
             for k in form.changed_data
-        })
+        }
+        if "linked_orderpositions" in data:
+            data["linked_orderpositions"] = data["linked_orderpositions"].values_list("pk", flat=True)
+        form.instance.log_action('pretix.reusable_medium.created', user=self.request.user, data=data)
         messages.success(self.request, _('Your changes have been saved.'))
         return r
 
@@ -3461,13 +3467,40 @@ class ReusableMediumUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequ
 
     @transaction.atomic
     def form_valid(self, form):
+        prev_linked_ops_pks = list(getattr(self.object, "linked_orderpositions").values_list("pk", flat=True))
+        result = super().form_valid(form)
         if form.has_changed():
-            self.object.log_action('pretix.reusable_medium.changed', user=self.request.user, data={
+            data = {
                 k: getattr(self.object, k)
                 for k in form.changed_data
-            })
+            }
+            if "linked_orderpositions" in data:
+                # handle changes to linked_orderpositions separately
+                linked_ops_pks = data["linked_orderpositions"].values_list("pk", flat=True)
+                del data["linked_orderpositions"]
+                for op_pk in prev_linked_ops_pks:
+                    if op_pk not in linked_ops_pks:
+                        self.object.log_action(
+                            'pretix.reusable_medium.linked_orderposition.removed',
+                            user=self.request.user,
+                            data={
+                                'linked_orderposition': op_pk,
+                            }
+                        )
+                for op_pk in linked_ops_pks:
+                    if op_pk not in prev_linked_ops_pks:
+                        self.object.log_action(
+                            'pretix.reusable_medium.linked_orderposition.added',
+                            user=self.request.user,
+                            data={
+                                'linked_orderposition': op_pk,
+                            }
+                        )
+            if data:
+                # log change-action only for changes other than linked_orderpositions
+                self.object.log_action('pretix.reusable_medium.changed', user=self.request.user, data=data)
         messages.success(self.request, _('Your changes have been saved.'))
-        return super().form_valid(form)
+        return result
 
     def get_success_url(self):
         return reverse('control:organizer.reusable_medium', kwargs={

src/pretix/control/views/subevents.py

@@ -41,7 +41,9 @@ from django.contrib import messages
 from django.core.exceptions import ValidationError
 from django.core.files import File
 from django.db import transaction
-from django.db.models import Count, F, Prefetch, ProtectedError
+from django.db.models import (
+    Count, Exists, F, OuterRef, Prefetch, ProtectedError, Subquery,
+)
 from django.db.models.functions import Coalesce, TruncDate, TruncTime
 from django.forms import inlineformset_factory
 from django.http import Http404, HttpResponse, HttpResponseRedirect
@@ -49,17 +51,21 @@ from django.shortcuts import redirect, render
 from django.urls import reverse
 from django.utils.formats import get_format
 from django.utils.functional import cached_property
+from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils.timezone import make_aware, now
 from django.utils.translation import gettext_lazy as _, pgettext_lazy
 from django.views import View
-from django.views.generic import CreateView, FormView, ListView, UpdateView
+from django.views.generic import (
+    CreateView, DetailView, FormView, ListView, UpdateView,
+)
 
-from pretix.base.models import CartPosition, LogEntry
+from pretix.base.models import CartPosition, LogEntry, OrderPosition
 from pretix.base.models.checkin import CheckinList
 from pretix.base.models.event import SubEvent, SubEventMetaValue
 from pretix.base.models.items import (
-    ItemVariation, Quota, SubEventItem, SubEventItemVariation,
+    Item, ItemVariation, Quota, SubEventItem, SubEventItemVariation,
 )
+from pretix.base.models.orders import CancellationRequest
 from pretix.base.reldate import RelativeDate, RelativeDateWrapper
 from pretix.base.services import tickets
 from pretix.base.services.quotas import QuotaAvailability
@@ -505,9 +511,68 @@ class SubEventEditorMixin(MetaDataEditorMixin):
         ) and self.cl_formset.is_valid() and all(f.is_valid() for f in self.plugin_forms)
 
 
-class SubEventUpdate(EventPermissionRequiredMixin, SubEventEditorMixin, UpdateView):
+class SubEventDetail(EventPermissionRequiredMixin, DetailView):
     model = SubEvent
     template_name = 'pretixcontrol/subevents/detail.html'
+    permission = None
+    context_object_name = 'subevent'
+
+    def get_object(self, queryset=None) -> SubEvent:
+        try:
+            return self.request.event.subevents.get(
+                id=self.kwargs['subevent']
+            )
+        except SubEvent.DoesNotExist:
+            raise Http404(pgettext_lazy("subevent", "The requested date does not exist."))
+
+    def get_context_data(self, **kwargs):
+        oqs = self.request.event.orders.filter(
+            Exists(
+                OrderPosition.objects.filter(
+                    subevent=self.object,
+                    order_id=OuterRef("id"),
+                )
+            )
+        ).annotate(
+            pcnt=Subquery(
+                OrderPosition.objects.filter(
+                    subevent=self.object,
+                ).values("subevent").annotate(c=Count("*")).values("c")
+            ),
+            has_cancellation_request=Exists(CancellationRequest.objects.filter(order=OuterRef("pk"))),
+        ).select_related("invoice_address").prefetch_related("sales_channel")
+        ctx = {
+            "quotas": self.object.quotas.prefetch_related(
+                Prefetch(
+                    "items",
+                    queryset=Item.objects.annotate(
+                        has_variations=Exists(ItemVariation.objects.filter(item=OuterRef("pk")))
+                    ),
+                    to_attr="cached_items"
+                ),
+                "variations",
+                "variations__item",
+            ).order_by("name", "pk"),
+            "checkinlists": self.object.checkinlist_set.prefetch_related("limit_products"),
+            "orders": oqs[:11],
+            "order_count": oqs.count(),
+        }
+
+        qa = QuotaAvailability()
+        qa.queue(*ctx["quotas"])
+        qa.compute()
+        for quota in ctx["quotas"]:
+            quota.cached_avail = qa.results[quota]
+
+        return super().get_context_data(
+            **kwargs,
+            **ctx,
+        )
+
+
+class SubEventUpdate(EventPermissionRequiredMixin, SubEventEditorMixin, UpdateView):
+    model = SubEvent
+    template_name = 'pretixcontrol/subevents/edit.html'
     permission = 'event.subevents:write'
     context_object_name = 'subevent'
     form_class = SubEventForm
@@ -573,20 +638,28 @@ class SubEventUpdate(EventPermissionRequiredMixin, SubEventEditorMixin, UpdateVi
         return HttpResponseRedirect(self.get_success_url())
 
     def get_success_url(self) -> str:
-        return reverse('control:event.subevents', kwargs={
+        if "next" in self.request.GET and url_has_allowed_host_and_scheme(self.request.GET.get("next"), allowed_hosts=None):
+            return self.request.GET.get("next")
+        return reverse('control:event.subevent', kwargs={
             'organizer': self.request.event.organizer.slug,
             'event': self.request.event.slug,
-        }) + ('?' + self.request.GET.get('returnto') if 'returnto' in self.request.GET else '')
+            'subevent': self.object.pk,
+        })
 
     def get_form_kwargs(self):
         kwargs = super().get_form_kwargs()
         kwargs['event'] = self.request.event
         return kwargs
 
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(
+            next_url=self.get_success_url()
+        )
+
 
 class SubEventCreate(SubEventEditorMixin, EventPermissionRequiredMixin, CreateView):
     model = SubEvent
-    template_name = 'pretixcontrol/subevents/detail.html'
+    template_name = 'pretixcontrol/subevents/edit.html'
     permission = 'event.subevents:write'
     context_object_name = 'subevent'
     form_class = SubEventForm

src/pretix/control/views/typeahead.py

@@ -145,11 +145,21 @@ def event_list(request):
     if 'can_copy' in request.GET:
         qs = EventWizardCopyForm.copy_from_queryset(request.user, request.session)
     else:
-        qs = request.user.get_events_with_any_permission(request)
+        permission = request.GET.get('permission')
+        if permission:
+            qs = request.user.get_events_with_permission(permission, request)
+        else:
+            qs = request.user.get_events_with_any_permission(request)
+
+    name_slug_q = Q(name__icontains=i18ncomp(query)) | Q(slug__icontains=query)
+    organizer = request.GET.get('organizer')
+    if organizer:
+        qs = qs.filter(organizer__slug=organizer)
+    else:
+        name_slug_q |= Q(organizer__name__icontains=i18ncomp(query)) | Q(organizer__slug__icontains=query)
 
     qs = qs.filter(
-        Q(name__icontains=i18ncomp(query)) | Q(slug__icontains=query) |
-        Q(organizer__name__icontains=i18ncomp(query)) | Q(organizer__slug__icontains=query)
+        name_slug_q
     ).annotate(
         min_from=Min('subevents__date_from'),
         max_from=Max('subevents__date_from'),
@@ -162,10 +172,19 @@ def event_list(request):
     total = qs.count()
     pagesize = 20
     offset = (page - 1) * pagesize
+    results = []
+    if page == 1 and 'include_none' in request.GET and not query:
+        results.append({
+            'id': "_none",
+            'text': _("No event"),
+            'name': _("No event"),
+            'type': "event",
+        })
+    results += [
+        serialize_event(e) for e in qs.select_related('organizer')[offset:offset + pagesize]
+    ]
     doc = {
-        'results': [
-            serialize_event(e) for e in qs.select_related('organizer')[offset:offset + pagesize]
-        ],
+        'results': results,
         'pagination': {
             "more": total >= (offset + pagesize)
         }
@@ -181,7 +200,7 @@ def giftcard_select2(request, **kwargs):
     except ValueError:
         page = 1
 
-    if request.user.has_organizer_permission(request.organizer, 'organizer.giftcards:write', request):
+    if request.user.has_organizer_permission(request.organizer, 'organizer.giftcards:read', request):
         qs = request.organizer.issued_gift_cards.filter(
             Q(secret__icontains=query)
         ).order_by('secret')

src/pretix/locale/de/LC_MESSAGES/django.po

@@ -5,16 +5,16 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-05-27 15:47+0000\n"
-"PO-Revision-Date: 2026-05-27 15:20+0000\n"
-"Last-Translator: Raphael Michel <michel@rami.io>\n"
-"Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix/de/"
-">\n"
+"PO-Revision-Date: 2026-06-09 20:00+0000\n"
+"Last-Translator: Mira <weller@rami.io>\n"
+"Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix/"
+"de/>\n"
 "Language: de\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.5\n"
+"X-Generator: Weblate 2026.6.1\n"
 "X-Poedit-Bookmarks: -1,-1,904,-1,-1,-1,-1,-1,-1,-1\n"
 
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html:670
@@ -11353,7 +11353,7 @@ msgid ""
 msgstr ""
 "Wenn diese Option deaktiviert ist, werden Tickets nur für Produkte "
 "aktiviert, bei denen die Option \"Berechtigt zum Eintritt\" gesetzt ist. Sie "
-"können die Ticketgenerierung auch in den Einstellungen von jedes Produktes "
+"können die Ticketgenerierung auch in den Einstellungen jedes Produktes "
 "einzeln abschalten."
 
 #: pretix/base/settings.py:1813

src/pretix/locale/de_Informal/LC_MESSAGES/django.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-05-27 15:47+0000\n"
-"PO-Revision-Date: 2026-05-27 15:20+0000\n"
-"Last-Translator: Raphael Michel <michel@rami.io>\n"
+"PO-Revision-Date: 2026-06-09 20:00+0000\n"
+"Last-Translator: Mira <weller@rami.io>\n"
 "Language-Team: German (informal) <https://translate.pretix.eu/projects/"
 "pretix/pretix/de_Informal/>\n"
 "Language: de_Informal\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.5\n"
+"X-Generator: Weblate 2026.6.1\n"
 
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html:670
 #: pretix/control/templates/pretixcontrol/events/index.html:166
@@ -11339,8 +11339,8 @@ msgid ""
 "issuing in every product separately."
 msgstr ""
 "Wenn diese Option deaktiviert ist, werden Tickets nur für Produkte "
-"aktiviert, bei denen die Option \"Berechtigt zum Eintritt\" gesetzt ist. Sie "
-"können die Ticketgenerierung auch in den Einstellungen von jedes Produktes "
+"aktiviert, bei denen die Option \"Berechtigt zum Eintritt\" gesetzt ist. Du "
+"kannst die Ticketgenerierung auch in den Einstellungen jedes Produktes "
 "einzeln abschalten."
 
 #: pretix/base/settings.py:1813

src/pretix/locale/es/LC_MESSAGES/django.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-05-27 15:47+0000\n"
-"PO-Revision-Date: 2026-05-01 21:00+0000\n"
-"Last-Translator: Paul Berschick <paul@plainschwarz.com>\n"
+"PO-Revision-Date: 2026-05-29 17:00+0000\n"
+"Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
 "Language-Team: Spanish <https://translate.pretix.eu/projects/pretix/pretix/"
 "es/>\n"
 "Language: es\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.17\n"
+"X-Generator: Weblate 2026.5\n"
 
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html:670
 #: pretix/control/templates/pretixcontrol/events/index.html:166
@@ -620,16 +620,17 @@ msgstr ""
 "como variaciones o paquetes."
 
 #: pretix/api/webhooks.py:413
-#, fuzzy
-#| msgid "Quota handling"
 msgid "Quota changed"
-msgstr "Gestión de cuotas"
+msgstr "Se ha modificado la cuota"
 
 #: pretix/api/webhooks.py:414
 msgid ""
 "This includes related events like creation, deletion, opening or closing of "
 "quotas. No webhook is sent for changes to the resulting availability."
 msgstr ""
+"Esto incluye acciones relacionadas, como la creación, la eliminación, la "
+"apertura o el cierre de cuotas. No se envía ningún webhook cuando se "
+"producen cambios en la disponibilidad resultante."
 
 #: pretix/api/webhooks.py:419
 msgid "Shop taken live"
@@ -3418,11 +3419,13 @@ msgid ""
 "The field \"%(label)s\" may not contain special characters such as "
 "\"%(chars)s\"."
 msgstr ""
+"El campo «%(label)s» no puede contener caracteres especiales como «%(chars)s"
+"»."
 
 #: pretix/base/forms/questions.py:305
 #, python-format
 msgid "The field \"%(label)s\" may not contain an URL (%(url)s)."
-msgstr ""
+msgstr "El campo «%(label)s» no puede contener una URL (%(url)s)."
 
 #: pretix/base/forms/questions.py:338
 msgctxt "phonenumber"
@@ -8361,19 +8364,14 @@ msgid "Program times"
 msgstr "Horarios del programa"
 
 #: pretix/base/pdf.py:503
-#, fuzzy
-#| msgid ""
-#| "2017-05-31 10:00 – 12:00\n"
-#| "2017-05-31 14:00 – 16:00\n"
-#| "2017-05-31 14:00 – 2017-06-01 14:00"
 msgid ""
 "2017-05-31 10:00 – 12:00, Room 1\n"
 "2017-05-31 14:00 – 16:00, Room 2\n"
 "2017-05-31 14:00 – 2017-06-01 14:00, Building A"
 msgstr ""
-"2017-05-31 10:00 – 12:00\n"
-"2017-05-31 14:00 – 16:00\n"
-"2017-05-31 14:00 – 2017-06-01 14:00"
+"31 de mayo de 2017, de 10:00 a 12:00, Sala 1\n"
+"31 de mayo de 2017, de 14:00 a 16:00, Sala 2\n"
+"31 de mayo de 2017, de 14:00 a 1 de junio de 2017, 14:00, Edificio A"
 
 #: pretix/base/pdf.py:507
 msgid "Reusable Medium ID"
@@ -8903,13 +8901,7 @@ msgid "This voucher code is not known in our database."
 msgstr "Este vale de compra no se conoce en nuestra base de datos."
 
 #: pretix/base/services/cart.py:165
-#, fuzzy, python-format
-#| msgid ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products."
-#| msgid_plural ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products."
+#, python-format
 msgid ""
 "The voucher code \"%(voucher)s\" can only be used if you select at least "
 "%(number)s matching product."
@@ -8917,22 +8909,14 @@ msgid_plural ""
 "The voucher code \"%(voucher)s\" can only be used if you select at least "
 "%(number)s matching products."
 msgstr[0] ""
-"El vale de compra \"%(voucher)s\" solo se puede utilizar si selecciona al "
-"menos %(number)s productos coincidentes."
+"El código de descuento «%(voucher)s» solo se puede utilizar si seleccionas "
+"al menos%(number)s productos que cumplan los requisitos."
 msgstr[1] ""
-"Los vales de compra \"%(voucher)s\" solo se pueden utilizar si selecciona al "
-"menos %(number)s productos coincidentes."
+"El código de descuento «%(voucher)s» solo se puede utilizar si seleccionas "
+"al menos %(number)s productos que cumplan los requisitos."
 
 #: pretix/base/services/cart.py:170
-#, fuzzy, python-format
-#| msgid ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products. We have therefore removed some positions "
-#| "from your cart that can no longer be purchased like this."
-#| msgid_plural ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products. We have therefore removed some positions "
-#| "from your cart that can no longer be purchased like this."
+#, python-format
 msgid ""
 "The voucher code \"%(voucher)s\" can only be used if you select at least "
 "%(number)s matching product. We have therefore removed some positions from "
@@ -8942,13 +8926,15 @@ msgid_plural ""
 "%(number)s matching products. We have therefore removed some positions from "
 "your cart that can no longer be purchased like this."
 msgstr[0] ""
-"El vale de compra \"%(voucher)s\" solo se puede utilizar si selecciona al "
-"menos %(number)s productos coincidentes. Por lo tanto, hemos eliminado "
-"algunas posiciones de su carrito que ya no se pueden comprar así."
+"El código promocional «%(voucher)s» solo se puede utilizar si seleccionas al "
+"menos %(number)s producto que cumpla los requisitos. Por lo tanto, hemos "
+"eliminado de tu carrito algunos artículos que ya no se pueden comprar de "
+"esta forma."
 msgstr[1] ""
-"Los vale de compra \"%(voucher)s\" solo se pueden utilizar si selecciona al "
-"menos %(number)s productos coincidentes. Por lo tanto, hemos eliminado "
-"algunas posiciones de su carrito que ya no se pueden comprar así."
+"El código promocional «%(voucher)s» solo se puede utilizar si seleccionas al "
+"menos %(number)s productos que cumplan los requisitos. Por lo tanto, hemos "
+"eliminado de tu carrito algunos artículos que ya no se pueden comprar de "
+"esta forma."
 
 #: pretix/base/services/cart.py:176
 msgid ""
@@ -14254,6 +14240,8 @@ msgid ""
 "You entered an URL, which is not allowed. Please remove %(match)s from your "
 "input."
 msgstr ""
+"Ha introducido una URL que no está permitida. Elimina %(match)s de su "
+"entrada."
 
 #: pretix/base/views/errors.py:48
 msgid ""
@@ -16194,14 +16182,8 @@ msgid "inactive"
 msgstr "inactivo"
 
 #: pretix/control/forms/item.py:1414
-#, fuzzy
-#| msgid ""
-#| "Sample Conference Center\n"
-#| "Heidelberg, Germany"
 msgid "Sample Conference Center, Heidelberg, Germany"
-msgstr ""
-"Ejemplo de Centro de Conferencia \n"
-"Heidelberg, Alemania"
+msgstr "Ejemplo de Centro de Conferencia : Heidelberg, Alemania"
 
 #: pretix/control/forms/mailsetup.py:42
 msgid "Hostname"
@@ -23659,11 +23641,8 @@ msgid "Quota history"
 msgstr "Historial de cuotas"
 
 #: pretix/control/templates/pretixcontrol/items/quota_bulk_edit.html:6
-#, fuzzy
-#| msgctxt "subevent"
-#| msgid "Change multiple dates"
 msgid "Change multiple quotas"
-msgstr "Cambiar varias fechas"
+msgstr "Modificar varias cuotas"
 
 #: pretix/control/templates/pretixcontrol/items/quota_bulk_edit.html:8
 #: pretix/control/templates/pretixcontrol/organizers/device_bulk_edit.html:8
@@ -23713,18 +23692,15 @@ msgstr ""
 
 #: pretix/control/templates/pretixcontrol/items/quota_delete_bulk.html:4
 #: pretix/control/templates/pretixcontrol/items/quota_delete_bulk.html:6
-#, fuzzy
-#| msgid "Delete quota"
 msgid "Delete quotas"
-msgstr "Borrar cuota"
+msgstr "Eliminar cuotas"
 
 #: pretix/control/templates/pretixcontrol/items/quota_delete_bulk.html:10
-#, fuzzy, python-format
-#| msgid "Are you sure you want to delete the following dates?"
+#, python-format
 msgid "Are you sure you want to delete the following quota?"
 msgid_plural "Are you sure you want to delete the following %(num)s quotas?"
-msgstr[0] "¿Está seguro de que desea borrar las fechas siguientes?"
-msgstr[1] "¿Está seguro de que desea borrar las fechas siguientes?"
+msgstr[0] "¿Está seguro de que desea eliminar la siguiente cuota?"
+msgstr[1] "¿Está seguro de que desea eliminar las siguientes %(num)s cuotas?"
 
 #: pretix/control/templates/pretixcontrol/items/quotas.html:9
 msgid ""
@@ -24329,12 +24305,15 @@ msgid ""
 "generated once the customer pays the invoice or selects a payment method "
 "that requires an invoice."
 msgstr ""
+"Este pedido se modificó después de que se generara la última factura. Aún no "
+"se ha generado una nueva factura, ya que las facturas están configuradas "
+"para generarse al realizar el pago o si así lo exige la forma de pago. Se "
+"generará una nueva factura una vez que el cliente abone la factura o "
+"seleccione una forma de pago que requiera una factura."
 
 #: pretix/control/templates/pretixcontrol/order/index.html:152
-#, fuzzy
-#| msgid "Request invoice"
 msgid "Reissue invoice"
-msgstr "Solicitar factura"
+msgstr "Reemitir factura"
 
 #: pretix/control/templates/pretixcontrol/order/index.html:161
 #: pretix/control/templates/pretixcontrol/order/index.html:413
@@ -24765,23 +24744,16 @@ msgid "How should the refund be sent?"
 msgstr "¿Cómo se debe de realizar este reembolso?"
 
 #: pretix/control/templates/pretixcontrol/order/refund_choose.html:25
-#, fuzzy
-#| msgid ""
-#| "Any payments that you selected for automatical refunds will be "
-#| "immediately communicate the refund request to the respective payment "
-#| "provider. Manual refunds will be created as pending refunds, you can then "
-#| "later mark them as done once you actually transferred the money back to "
-#| "the customer."
 msgid ""
 "Any payments you selected for automatic refunds will have the refund request "
 "sent immediately to the respective payment provider. Manual refunds will be "
 "created as pending refunds, which you can later mark as done once you have "
 "actually transferred the money back to the customer."
 msgstr ""
-"Cualquier pago que haya seleccionado de manera automática para reembolso "
-"será comunicado inmediatamente a la entidad de pago correspondiente. Los "
-"devoluciones manuales se crearán como reembolsos pendientes, podrá marcarlos "
-"como hechos una vez que se haya transferido el dinero al cliente."
+"Los pagos que hayas seleccionado para reembolsos automáticos se enviarán "
+"inmediatamente al proveedor de pagos correspondiente. Los reembolsos "
+"manuales se crearán como reembolsos pendientes, que podrás marcar como "
+"completados más adelante, una vez que hayas devuelto el dinero al cliente."
 
 #: pretix/control/templates/pretixcontrol/order/refund_choose.html:32
 msgid "Refund to original payment method"
@@ -29337,11 +29309,8 @@ msgid "The new question has been created."
 msgstr "La nueva pregunta ha sido creada."
 
 #: pretix/control/views/item.py:918
-#, fuzzy
-#| msgctxt "subevent"
-#| msgid "The selected dates have been deleted or disabled."
 msgid "The selected quotas have been deleted or disabled."
-msgstr "Las fechas seleccionadas se han borrado o desactivado."
+msgstr "Las cuotas seleccionadas se han eliminado o desactivado."
 
 #: pretix/control/views/item.py:1074
 msgid "The new quota has been created."
@@ -30073,11 +30042,9 @@ msgstr ""
 "Este plugin no está permitido actualmente para su cuenta de organizador."
 
 #: pretix/control/views/organizer.py:832
-#, fuzzy, python-brace-format
-#| msgid "This plugin can be enabled or disabled for events individually."
+#, python-brace-format
 msgid "This plugin cannot be activated for event {}."
-msgstr ""
-"Este plugin se puede activar o desactivar para eventos de forma individual."
+msgstr "Este complemento no se puede activar para el evento {}."
 
 #: pretix/control/views/organizer.py:901
 msgid "The team has been created. You can now add members to the team."
@@ -31122,10 +31089,9 @@ msgid "{width} x {height} mm label"
 msgstr "etiqueta {width} x {height} mm"
 
 #: pretix/plugins/badges/templates.py:265
-#, fuzzy, python-brace-format
-#| msgid "{width} x {height} mm label"
+#, python-brace-format
 msgid "{width} x {height} inch label"
-msgstr "etiqueta {width} x {height} mm"
+msgstr "Etiqueta de {width} x {height} pulgadas"
 
 #: pretix/plugins/badges/templates/pretixplugins/badges/control_order_info.html:16
 #: pretix/plugins/badges/templates/pretixplugins/badges/index.html:27

src/pretix/locale/fr/LC_MESSAGES/django.po

@@ -4,16 +4,16 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-05-27 15:47+0000\n"
-"PO-Revision-Date: 2026-05-08 04:00+0000\n"
-"Last-Translator: corentin-spec <corentin@spectentaculaire.fr>\n"
-"Language-Team: French <https://translate.pretix.eu/projects/pretix/pretix/fr/"
-">\n"
+"PO-Revision-Date: 2026-06-08 17:00+0000\n"
+"Last-Translator: Sébastien BRUNEAU <s.bruneau@beauvaisis.fr>\n"
+"Language-Team: French <https://translate.pretix.eu/projects/pretix/pretix/"
+"fr/>\n"
 "Language: fr\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n > 1;\n"
-"X-Generator: Weblate 5.17.1\n"
+"X-Generator: Weblate 2026.6.1\n"
 
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html:670
 #: pretix/control/templates/pretixcontrol/events/index.html:166
@@ -618,16 +618,17 @@ msgstr ""
 "aux objets imbriqués tels que les variantes ou les lots."
 
 #: pretix/api/webhooks.py:413
-#, fuzzy
-#| msgid "Quota handling"
 msgid "Quota changed"
-msgstr "Traitement des quotas"
+msgstr "Quota modifié"
 
 #: pretix/api/webhooks.py:414
 msgid ""
 "This includes related events like creation, deletion, opening or closing of "
 "quotas. No webhook is sent for changes to the resulting availability."
 msgstr ""
+"Cela inclut les événements associés, tels que la création, la suppression, "
+"l'ouverture ou la suppression de quotas. Aucun webhook n'est envoyé en cas "
+"de modification de la disponibilité qui en résulte."
 
 #: pretix/api/webhooks.py:419
 msgid "Shop taken live"
@@ -3422,11 +3423,13 @@ msgid ""
 "The field \"%(label)s\" may not contain special characters such as "
 "\"%(chars)s\"."
 msgstr ""
+"Le champ « %(label)s » ne doit pas contenir de caractères spéciaux tels que "
+"«%(chars)s »."
 
 #: pretix/base/forms/questions.py:305
 #, python-format
 msgid "The field \"%(label)s\" may not contain an URL (%(url)s)."
-msgstr ""
+msgstr "Le champ « %(label)s » ne doit pas contenir d'URL (%(url)s)."
 
 #: pretix/base/forms/questions.py:338
 msgctxt "phonenumber"
@@ -8409,19 +8412,14 @@ msgid "Program times"
 msgstr "Horaires du programme"
 
 #: pretix/base/pdf.py:503
-#, fuzzy
-#| msgid ""
-#| "2017-05-31 10:00 – 12:00\n"
-#| "2017-05-31 14:00 – 16:00\n"
-#| "2017-05-31 14:00 – 2017-06-01 14:00"
 msgid ""
 "2017-05-31 10:00 – 12:00, Room 1\n"
 "2017-05-31 14:00 – 16:00, Room 2\n"
 "2017-05-31 14:00 – 2017-06-01 14:00, Building A"
 msgstr ""
-"2017-05-31 10:00 – 12:00\n"
-"2017-05-31 14:00 – 16:00\n"
-"2017-05-31 14:00 – 2017-06-01 14:00"
+"31 mai 2017, de 10 h à 12 h, salle 1\n"
+"31 mai 2017, de 14 h à 16 h, salle 2\n"
+"Du 31 mai 2017 à 1 h du matin au 1er juin 2017 à 14 h, bâtiment A"
 
 #: pretix/base/pdf.py:507
 msgid "Reusable Medium ID"
@@ -8957,13 +8955,7 @@ msgid "This voucher code is not known in our database."
 msgstr "Ce code promotionnel n'est pas connu dans notre base de données."
 
 #: pretix/base/services/cart.py:165
-#, fuzzy, python-format
-#| msgid ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products."
-#| msgid_plural ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products."
+#, python-format
 msgid ""
 "The voucher code \"%(voucher)s\" can only be used if you select at least "
 "%(number)s matching product."
@@ -8971,22 +8963,14 @@ msgid_plural ""
 "The voucher code \"%(voucher)s\" can only be used if you select at least "
 "%(number)s matching products."
 msgstr[0] ""
-"Le code promo \"%(voucher)s\" ne peut être utilisé que si vous sélectionnez "
+"Le code promo « %(voucher)s » ne peut être utilisé que si vous sélectionnez "
 "au moins %(number)s produit correspondant."
 msgstr[1] ""
-"Le code promo \"%(voucher)s\" ne peut être utilisé que si vous sélectionnez "
+"Le code promo « %(voucher)s » ne peut être utilisé que si vous sélectionnez "
 "au moins %(number)s produits correspondants."
 
 #: pretix/base/services/cart.py:170
-#, fuzzy, python-format
-#| msgid ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products. We have therefore removed some positions "
-#| "from your cart that can no longer be purchased like this."
-#| msgid_plural ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products. We have therefore removed some positions "
-#| "from your cart that can no longer be purchased like this."
+#, python-format
 msgid ""
 "The voucher code \"%(voucher)s\" can only be used if you select at least "
 "%(number)s matching product. We have therefore removed some positions from "
@@ -14379,6 +14363,8 @@ msgid ""
 "You entered an URL, which is not allowed. Please remove %(match)s from your "
 "input."
 msgstr ""
+"Vous avez saisi une URL, ce qui n'est pas autorisé. Veuillez supprimer %"
+"(match)s de votre saisie."
 
 #: pretix/base/views/errors.py:48
 msgid ""
@@ -16328,14 +16314,8 @@ msgid "inactive"
 msgstr "inactif"
 
 #: pretix/control/forms/item.py:1414
-#, fuzzy
-#| msgid ""
-#| "Sample Conference Center\n"
-#| "Heidelberg, Germany"
 msgid "Sample Conference Center, Heidelberg, Germany"
-msgstr ""
-"Exemple de centre de conférence\n"
-"Centre des Congrès, France"
+msgstr "Centre de conférences d'exemple, Heidelberg, Allemagne"
 
 #: pretix/control/forms/mailsetup.py:42
 msgid "Hostname"
@@ -23831,11 +23811,8 @@ msgid "Quota history"
 msgstr "Historique des quotas"
 
 #: pretix/control/templates/pretixcontrol/items/quota_bulk_edit.html:6
-#, fuzzy
-#| msgctxt "subevent"
-#| msgid "Change multiple dates"
 msgid "Change multiple quotas"
-msgstr "Modifier plusieurs dates"
+msgstr "Modifier plusieurs quotas"
 
 #: pretix/control/templates/pretixcontrol/items/quota_bulk_edit.html:8
 #: pretix/control/templates/pretixcontrol/organizers/device_bulk_edit.html:8
@@ -23883,18 +23860,15 @@ msgstr "Les produits suivants pourraient ne plus être disponibles à la vente
 
 #: pretix/control/templates/pretixcontrol/items/quota_delete_bulk.html:4
 #: pretix/control/templates/pretixcontrol/items/quota_delete_bulk.html:6
-#, fuzzy
-#| msgid "Delete quota"
 msgid "Delete quotas"
-msgstr "Supprimer le quota"
+msgstr "Supprimer les quotas"
 
 #: pretix/control/templates/pretixcontrol/items/quota_delete_bulk.html:10
-#, fuzzy, python-format
-#| msgid "Are you sure you want to delete the following dates?"
+#, python-format
 msgid "Are you sure you want to delete the following quota?"
 msgid_plural "Are you sure you want to delete the following %(num)s quotas?"
-msgstr[0] "Voulez-vous vraiment supprimer les dates suivantes ?"
-msgstr[1] "Voulez-vous vraiment supprimer les dates suivantes ?"
+msgstr[0] "Êtes-vous sûr de vouloir supprimer le quota suivant ?"
+msgstr[1] "Êtes-vous sûr de vouloir supprimer les %(num)s quotas suivants ?"
 
 #: pretix/control/templates/pretixcontrol/items/quotas.html:9
 msgid ""
@@ -24503,12 +24477,15 @@ msgid ""
 "generated once the customer pays the invoice or selects a payment method "
 "that requires an invoice."
 msgstr ""
+"Cette commande a été modifiée après l'émission de la dernière facture. "
+"Aucune nouvelle facture n'a encore été générée, car les factures sont "
+"configurées pour être émises lors du paiement ou si le mode de paiement "
+"l'exige. Une nouvelle facture sera générée dès que le client aura réglé la "
+"facture ou choisi un mode de paiement nécessitant une facture."
 
 #: pretix/control/templates/pretixcontrol/order/index.html:152
-#, fuzzy
-#| msgid "Request invoice"
 msgid "Reissue invoice"
-msgstr "Demande de facture"
+msgstr "Réémettre une facture"
 
 #: pretix/control/templates/pretixcontrol/order/index.html:161
 #: pretix/control/templates/pretixcontrol/order/index.html:413
@@ -24942,25 +24919,17 @@ msgid "How should the refund be sent?"
 msgstr "Comment le remboursement doit-il être envoyé ?"
 
 #: pretix/control/templates/pretixcontrol/order/refund_choose.html:25
-#, fuzzy
-#| msgid ""
-#| "Any payments that you selected for automatical refunds will be "
-#| "immediately communicate the refund request to the respective payment "
-#| "provider. Manual refunds will be created as pending refunds, you can then "
-#| "later mark them as done once you actually transferred the money back to "
-#| "the customer."
 msgid ""
 "Any payments you selected for automatic refunds will have the refund request "
 "sent immediately to the respective payment provider. Manual refunds will be "
 "created as pending refunds, which you can later mark as done once you have "
 "actually transferred the money back to the customer."
 msgstr ""
-"Tous les paiements que vous avez sélectionnés pour des remboursements "
-"automatiques seront immédiatement communiqués à la demande de remboursement "
-"au fournisseur de paiement respectif. Les remboursements manuels seront "
-"créés en tant que remboursements en attente, vous pourrez ensuite les "
-"marquer comme terminés une fois que vous aurez effectivement transféré "
-"l’argent au client."
+"Pour tous les paiements que vous avez sélectionnés pour un remboursement "
+"automatique, la demande de remboursement sera immédiatement transmise au "
+"prestataire de paiement concerné. Les remboursements manuels seront "
+"enregistrés comme remboursements en attente ; vous pourrez les marquer comme "
+"effectués une fois que vous aurez effectivement reversé l'argent au client."
 
 #: pretix/control/templates/pretixcontrol/order/refund_choose.html:32
 msgid "Refund to original payment method"
@@ -29558,11 +29527,8 @@ msgid "The new question has been created."
 msgstr "La nouvelle question a été créée."
 
 #: pretix/control/views/item.py:918
-#, fuzzy
-#| msgctxt "subevent"
-#| msgid "The selected dates have been deleted or disabled."
 msgid "The selected quotas have been deleted or disabled."
-msgstr "Les dates sélectionnées ont été supprimées ou désactivées."
+msgstr "Les quotas sélectionnés ont été supprimés ou désactivés."
 
 #: pretix/control/views/item.py:1074
 msgid "The new quota has been created."
@@ -30302,12 +30268,9 @@ msgstr ""
 "Ce plugin n'est actuellement pas autorisé pour ce compte d'organisateur."
 
 #: pretix/control/views/organizer.py:832
-#, fuzzy, python-brace-format
-#| msgid "This plugin can be enabled or disabled for events individually."
+#, python-brace-format
 msgid "This plugin cannot be activated for event {}."
-msgstr ""
-"Ce plugin peut être activé ou désactivé individuellement pour chaque "
-"événement."
+msgstr "Ce plugin ne peut pas être activé pour l'événement {}."
 
 #: pretix/control/views/organizer.py:901
 msgid "The team has been created. You can now add members to the team."
@@ -31362,10 +31325,9 @@ msgid "{width} x {height} mm label"
 msgstr "{width} x {height} mm étiquette"
 
 #: pretix/plugins/badges/templates.py:265
-#, fuzzy, python-brace-format
-#| msgid "{width} x {height} mm label"
+#, python-brace-format
 msgid "{width} x {height} inch label"
-msgstr "{width} x {height} mm étiquette"
+msgstr "{width} x {height} pouce étiquette"
 
 #: pretix/plugins/badges/templates/pretixplugins/badges/control_order_info.html:16
 #: pretix/plugins/badges/templates/pretixplugins/badges/index.html:27
@@ -35161,7 +35123,7 @@ msgstr "Vous devez cocher toutes les cases en bas de la page."
 
 #: pretix/presale/forms/checkout.py:67
 msgid "Email address (repeated)"
-msgstr "Adresse de courriel (répété)"
+msgstr "Adresse de courriel (répétée)"
 
 #: pretix/presale/forms/checkout.py:68
 msgid ""

src/pretix/locale/ja/LC_MESSAGES/django.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-05-27 15:47+0000\n"
-"PO-Revision-Date: 2026-05-12 06:34+0000\n"
-"Last-Translator: Yasunobu YesNo Kawaguchi <kawaguti@gmail.com>\n"
+"PO-Revision-Date: 2026-06-01 09:00+0000\n"
+"Last-Translator: Hijiri Umemoto <hijiri@umemoto.org>\n"
 "Language-Team: Japanese <https://translate.pretix.eu/projects/pretix/pretix/"
 "ja/>\n"
 "Language: ja\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=1; plural=0;\n"
-"X-Generator: Weblate 5.17.1\n"
+"X-Generator: Weblate 2026.5\n"
 
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html:670
 #: pretix/control/templates/pretixcontrol/events/index.html:166
@@ -608,20 +608,20 @@ msgstr ""
 "更を含みます。"
 
 #: pretix/api/webhooks.py:413
-#, fuzzy
-#| msgid "Quota handling"
 msgid "Quota changed"
-msgstr "クォータの処理"
+msgstr "クォータが変更されました"
 
 #: pretix/api/webhooks.py:414
 msgid ""
 "This includes related events like creation, deletion, opening or closing of "
 "quotas. No webhook is sent for changes to the resulting availability."
 msgstr ""
+"これには、クォータの作成、削除、開始または終了といった関連イベントが含まれま"
+"す。結果として得られる可用性の変更については、Webhookが送信されません。"
 
 #: pretix/api/webhooks.py:419
 msgid "Shop taken live"
-msgstr "ショップが公開中になりました"
+msgstr "ショップがオンラインになりました"
 
 #: pretix/api/webhooks.py:423
 msgid "Shop taken offline"
@@ -3394,11 +3394,13 @@ msgid ""
 "The field \"%(label)s\" may not contain special characters such as "
 "\"%(chars)s\"."
 msgstr ""
+"フィールド「%(label)s」には、\"%(chars)s\" のような特殊文字を含めることはでき"
+"ません。"
 
 #: pretix/base/forms/questions.py:305
 #, python-format
 msgid "The field \"%(label)s\" may not contain an URL (%(url)s)."
-msgstr ""
+msgstr "フィールド「%(label)s」には URL (%(url)s) を含めることができません。"
 
 #: pretix/base/forms/questions.py:338
 msgctxt "phonenumber"
@@ -8189,19 +8191,14 @@ msgid "Program times"
 msgstr "プログラム時間"
 
 #: pretix/base/pdf.py:503
-#, fuzzy
-#| msgid ""
-#| "2017-05-31 10:00 – 12:00\n"
-#| "2017-05-31 14:00 – 16:00\n"
-#| "2017-05-31 14:00 – 2017-06-01 14:00"
 msgid ""
 "2017-05-31 10:00 – 12:00, Room 1\n"
 "2017-05-31 14:00 – 16:00, Room 2\n"
 "2017-05-31 14:00 – 2017-06-01 14:00, Building A"
 msgstr ""
-"2017-05-31 10:00 – 12:00\n"
-"2017-05-31 14:00 – 16:00\n"
-"2017-05-31 14:00 – 2017-06-01 14:00"
+"2017-05-31 10:00 – 12:00、部屋1\n"
+"2017-05-31 14:00 – 16:00、部屋2\n"
+"2017-05-31 14:00 – 2017-06-01 14:00、ビルA"
 
 #: pretix/base/pdf.py:507
 msgid "Reusable Medium ID"
@@ -8710,13 +8707,7 @@ msgid "This voucher code is not known in our database."
 msgstr "このバウチャーコードは、当社のデータベースには登録されていません。"
 
 #: pretix/base/services/cart.py:165
-#, fuzzy, python-format
-#| msgid ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products."
-#| msgid_plural ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products."
+#, python-format
 msgid ""
 "The voucher code \"%(voucher)s\" can only be used if you select at least "
 "%(number)s matching product."
@@ -8728,15 +8719,7 @@ msgstr[0] ""
 "した場合にのみ使用できます。"
 
 #: pretix/base/services/cart.py:170
-#, fuzzy, python-format
-#| msgid ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products. We have therefore removed some positions "
-#| "from your cart that can no longer be purchased like this."
-#| msgid_plural ""
-#| "The voucher code \"%(voucher)s\" can only be used if you select at least "
-#| "%(number)s matching products. We have therefore removed some positions "
-#| "from your cart that can no longer be purchased like this."
+#, python-format
 msgid ""
 "The voucher code \"%(voucher)s\" can only be used if you select at least "
 "%(number)s matching product. We have therefore removed some positions from "
@@ -13837,6 +13820,8 @@ msgid ""
 "You entered an URL, which is not allowed. Please remove %(match)s from your "
 "input."
 msgstr ""
+"URL を入力しましたが、許可されていません。入力から %(match)s を削除してくださ"
+"い。"
 
 #: pretix/base/views/errors.py:48
 msgid ""
@@ -15733,14 +15718,8 @@ msgid "inactive"
 msgstr "無効"
 
 #: pretix/control/forms/item.py:1414
-#, fuzzy
-#| msgid ""
-#| "Sample Conference Center\n"
-#| "Heidelberg, Germany"
 msgid "Sample Conference Center, Heidelberg, Germany"
-msgstr ""
-"サンプル・カンファレンスセンター\n"
-"ドイツ、ハイデルベルク"
+msgstr "サンプル・カンファレンスセンター, ドイツ, ハイデルベルク"
 
 #: pretix/control/forms/mailsetup.py:42
 msgid "Hostname"
@@ -22981,11 +22960,8 @@ msgid "Quota history"
 msgstr "クォータ履歴"
 
 #: pretix/control/templates/pretixcontrol/items/quota_bulk_edit.html:6
-#, fuzzy
-#| msgctxt "subevent"
-#| msgid "Change multiple dates"
 msgid "Change multiple quotas"
-msgstr "複数の日付を変更"
+msgstr "複数のクォータを変更"
 
 #: pretix/control/templates/pretixcontrol/items/quota_bulk_edit.html:8
 #: pretix/control/templates/pretixcontrol/organizers/device_bulk_edit.html:8
@@ -23031,17 +23007,14 @@ msgstr "以下の製品は販売できなくなる可能性があります："
 
 #: pretix/control/templates/pretixcontrol/items/quota_delete_bulk.html:4
 #: pretix/control/templates/pretixcontrol/items/quota_delete_bulk.html:6
-#, fuzzy
-#| msgid "Delete quota"
 msgid "Delete quotas"
 msgstr "クォータを削除"
 
 #: pretix/control/templates/pretixcontrol/items/quota_delete_bulk.html:10
-#, fuzzy, python-format
-#| msgid "Are you sure you want to delete the following dates?"
+#, python-format
 msgid "Are you sure you want to delete the following quota?"
 msgid_plural "Are you sure you want to delete the following %(num)s quotas?"
-msgstr[0] "以下の日付を削除してもよろしいですか？"
+msgstr[0] "以下の%(num)sのクォータを削除してもよろしいですか？"
 
 #: pretix/control/templates/pretixcontrol/items/quotas.html:9
 msgid ""
@@ -23634,12 +23607,14 @@ msgid ""
 "generated once the customer pays the invoice or selects a payment method "
 "that requires an invoice."
 msgstr ""
+"この注文は、最後の請求書が生成された後に変更されました。新しい請求書はまだ作"
+"成されていません。請求書は支払い時に生成されるか、支払方法によって必要とされ"
+"る場合に設定されているためです。お客様が請求書を支払うか、請求書が必要な支払"
+"方法を選択すると、新しい請求書が生成されます。"
 
 #: pretix/control/templates/pretixcontrol/order/index.html:152
-#, fuzzy
-#| msgid "Request invoice"
 msgid "Reissue invoice"
-msgstr "請求書を要求"
+msgstr "請求書を再発行する"
 
 #: pretix/control/templates/pretixcontrol/order/index.html:161
 #: pretix/control/templates/pretixcontrol/order/index.html:413
@@ -24064,22 +24039,15 @@ msgid "How should the refund be sent?"
 msgstr "どのように払い戻しますか？"
 
 #: pretix/control/templates/pretixcontrol/order/refund_choose.html:25
-#, fuzzy
-#| msgid ""
-#| "Any payments that you selected for automatical refunds will be "
-#| "immediately communicate the refund request to the respective payment "
-#| "provider. Manual refunds will be created as pending refunds, you can then "
-#| "later mark them as done once you actually transferred the money back to "
-#| "the customer."
 msgid ""
 "Any payments you selected for automatic refunds will have the refund request "
 "sent immediately to the respective payment provider. Manual refunds will be "
 "created as pending refunds, which you can later mark as done once you have "
 "actually transferred the money back to the customer."
 msgstr ""
-"自動払い戻しに選択した支払いは、該当する決済プロバイダーに払い戻し要求が即座"
-"に通知されます。手動払い戻しは保留中の払い戻しとして作成され、実際に顧客に送"
-"金した後で完了済みとしてマークできます。"
+"自動返金をご選択いただいたすべての支払いについては、返金リクエストが直ちに該"
+"当する決済プロバイダーへ送信されます。手動返金は保留中の返金として作成され、"
+"実際に顧客に返金した後で完了としてマークできます。"
 
 #: pretix/control/templates/pretixcontrol/order/refund_choose.html:32
 msgid "Refund to original payment method"
@@ -28504,11 +28472,8 @@ msgid "The new question has been created."
 msgstr "新しい質問が作成されました。"
 
 #: pretix/control/views/item.py:918
-#, fuzzy
-#| msgctxt "subevent"
-#| msgid "The selected dates have been deleted or disabled."
 msgid "The selected quotas have been deleted or disabled."
-msgstr "選択した日付は削除されたか無効になっています。"
+msgstr "選択したクォータは削除されたか無効です。"
 
 #: pretix/control/views/item.py:1074
 msgid "The new quota has been created."
@@ -29215,10 +29180,9 @@ msgid "This plugin is currently not allowed for this organizer account."
 msgstr "このプラグインは現在、この主催者アカウントでは許可されていません。"
 
 #: pretix/control/views/organizer.py:832
-#, fuzzy, python-brace-format
-#| msgid "This plugin can be enabled or disabled for events individually."
+#, python-brace-format
 msgid "This plugin cannot be activated for event {}."
-msgstr "このプラグインは、イベントごとに個別に有効化または無効化できます。"
+msgstr "このプラグインは、イベント{}に対してアクティベートできません。"
 
 #: pretix/control/views/organizer.py:901
 msgid "The team has been created. You can now add members to the team."
@@ -30236,10 +30200,9 @@ msgid "{width} x {height} mm label"
 msgstr "{width} x {height} mm ラベル"
 
 #: pretix/plugins/badges/templates.py:265
-#, fuzzy, python-brace-format
-#| msgid "{width} x {height} mm label"
+#, python-brace-format
 msgid "{width} x {height} inch label"
-msgstr "{width} x {height} mm ラベル"
+msgstr "{width} x {height} インチラベル"
 
 #: pretix/plugins/badges/templates/pretixplugins/badges/control_order_info.html:16
 #: pretix/plugins/badges/templates/pretixplugins/badges/index.html:27

src/pretix/locale/ko/LC_MESSAGES/django.po

@@ -8,16 +8,16 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-05-27 15:47+0000\n"
-"PO-Revision-Date: 2026-02-01 21:00+0000\n"
-"Last-Translator: z3rrry <z3rrry@gmail.com>\n"
-"Language-Team: Korean <https://translate.pretix.eu/projects/pretix/pretix/ko/"
-">\n"
+"PO-Revision-Date: 2026-06-01 09:00+0000\n"
+"Last-Translator: Hijiri Umemoto <hijiri@umemoto.org>\n"
+"Language-Team: Korean <https://translate.pretix.eu/projects/pretix/pretix/"
+"ko/>\n"
 "Language: ko\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=1; plural=0;\n"
-"X-Generator: Weblate 5.15.2\n"
+"X-Generator: Weblate 2026.5\n"
 
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html:670
 #: pretix/control/templates/pretixcontrol/events/index.html:166
@@ -48,7 +48,7 @@ msgstr "사전판매 시작하지 않음"
 #: pretix/control/templates/pretixcontrol/subevents/index.html:176
 #: pretix/control/views/dashboards.py:549
 msgid "On sale"
-msgstr ""
+msgstr "세일 중"
 
 #: pretix/_base_settings.py:89
 msgid "English"
@@ -427,10 +427,8 @@ msgstr ""
 
 #: pretix/api/serializers/organizer.py:495
 #: pretix/control/views/organizer.py:1035
-#, fuzzy
-#| msgid "pretix account invitation"
 msgid "Account invitation"
-msgstr "프레틱스 계정 초대"
+msgstr "계정 초대"
 
 #: pretix/api/serializers/organizer.py:516
 #: pretix/control/views/organizer.py:1134
@@ -18087,10 +18085,8 @@ msgid "A payment has been performed."
 msgstr "수동 거래가 수행되었습니다."
 
 #: pretix/control/logdisplay.py:807
-#, fuzzy
-#| msgid "A manual transaction has been performed."
 msgid "A refund has been performed. "
-msgstr "수동 거래가 수행되었습니다."
+msgstr "환불이 처리되었습니다. "
 
 #: pretix/control/logdisplay.py:808
 #, python-brace-format

src/pretix/locale/zh_Hant/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-05-27 15:47+0000\n"
-"PO-Revision-Date: 2026-05-21 15:08+0000\n"
+"PO-Revision-Date: 2026-06-01 09:00+0000\n"
 "Last-Translator: Hijiri Umemoto <hijiri@umemoto.org>\n"
 "Language-Team: Chinese (Traditional Han script) <https://translate.pretix.eu/"
 "projects/pretix/pretix/zh_Hant/>\n"
@@ -595,16 +595,16 @@ msgid ""
 msgstr "這包括新增或刪除的產品，以及對變體或捆綁等巢狀物件的更改。"
 
 #: pretix/api/webhooks.py:413
-#, fuzzy
-#| msgid "Quota handling"
 msgid "Quota changed"
-msgstr "額度處理"
+msgstr "配額改變了"
 
 #: pretix/api/webhooks.py:414
 msgid ""
 "This includes related events like creation, deletion, opening or closing of "
 "quotas. No webhook is sent for changes to the resulting availability."
 msgstr ""
+"這包括建立、刪除、開啟或關閉配額等相關事件。 沒有傳送webhook來更改結果的可用"
+"性。"
 
 #: pretix/api/webhooks.py:419
 msgid "Shop taken live"
@@ -650,7 +650,7 @@ msgstr "優惠券已更改"
 msgid ""
 "Only includes explicit changes to the voucher, not e.g. an increase of the "
 "number of redemptions."
-msgstr ""
+msgstr "僅包括對代金券的明確更改，例如不包括兌換次數的增加。"
 
 #: pretix/api/webhooks.py:460
 msgid "Voucher deleted"
@@ -669,22 +669,16 @@ msgid "Customer account anonymized"
 msgstr "客戶帳戶已匿名化"
 
 #: pretix/api/webhooks.py:476
-#, fuzzy
-#| msgid "Gift card code"
 msgid "Gift card added"
-msgstr "禮品卡代碼"
+msgstr "添加了禮品卡"
 
 #: pretix/api/webhooks.py:480
-#, fuzzy
-#| msgid "Gift card code"
 msgid "Gift card modified"
-msgstr "禮品卡代碼"
+msgstr "禮品卡修改了"
 
 #: pretix/api/webhooks.py:484
-#, fuzzy
-#| msgid "Gift card transactions"
 msgid "Gift card used in transaction"
-msgstr "禮品卡交易"
+msgstr "交易中使用的禮品卡"
 
 #: pretix/base/addressvalidation.py:100 pretix/base/addressvalidation.py:103
 #: pretix/base/addressvalidation.py:108 pretix/base/forms/questions.py:1074

src/pretix/plugins/reports/accountingreport.py

@@ -270,18 +270,18 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
     def _transaction_group_header_label(self):
         return _("Event") + " / " + _("Product")
 
-    def _transaction_group_label(self, form_data, r):
+    def _transaction_group(self, form_data, r):
         if not self.is_multievent and not form_data.get("split_subevents"):
-            return None
+            return None, None
         if r.get("subevent_id"):
             return "{} - {} ({}) [{}]".format(
                 r["order__event__name"],
                 r["subevent__name"],
                 date_format(r["subevent__date_from"]),
                 r["order__event__slug"]
-            )
+            ), f"subevent-{r['subevent_id']}"
         else:
-            return "{} [{}]".format(r["order__event__name"], r["order__event__slug"])
+            return "{} [{}]".format(r["order__event__name"], r["order__event__slug"]), f"event-{r['order__event__slug']}"
 
     def _transaction_row_label(self, r):
         if r["item_id"]:
@@ -343,17 +343,17 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
         last_group = None
         last_group_head_idx = 0
         for r in qs:
-            e = self._transaction_group_label(form_data, r)
+            group_label, group_id = self._transaction_group(form_data, r)
 
-            if e != last_group:
-                if last_group_head_idx > 0 and e is not None:
+            if group_id != last_group:
+                if last_group_head_idx > 0 and group_id is not None:
                     tdata[last_group_head_idx][4] = Paragraph(money_filter(sum_price_by_group - sum_tax_by_group, currency), tstyle_bold_right),
                     tdata[last_group_head_idx][5] = Paragraph(money_filter(sum_tax_by_group, currency), tstyle_bold_right),
                     tdata[last_group_head_idx][6] = Paragraph(money_filter(sum_price_by_group, currency), tstyle_bold_right),
                 tdata.append(
                     [
                         FontFallbackParagraph(
-                            e,
+                            group_label,
                             tstyle_bold,
                         ),
                         "",
@@ -367,7 +367,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
                 tstyledata.append(
                     ("SPAN", (0, len(tdata) - 1), (3, len(tdata) - 1)),
                 )
-                last_group = e
+                last_group = group_id
                 last_group_head_idx = len(tdata) - 1
                 sum_price_by_group = Decimal("0.00")
                 sum_tax_by_group = Decimal("0.00")

src/pretix/presale/templates/pretixpresale/fragment_js.html

@@ -22,4 +22,5 @@
     <script type="text/javascript" src="{% static "pretixpresale/js/ui/iframe.js" %}"></script>
     <script type="text/javascript" src="{% static "pretixbase/js/addressform.js" %}"></script>
     <script type="text/javascript" src="{% static "pretixbase/js/deanonymize_email.js" %}"></script>
+    <script type="text/javascript" src="{% static "pretixbase/js/errors.js" %}"></script>
 {% endcompress %}

src/pretix/presale/views/widget.py

@@ -128,6 +128,9 @@ def _use_vite(request):
     origin = request.META.get('HTTP_ORIGIN', '')
     gs = GlobalSettingsObject()
     vite_origins = gs.settings.get('widget_vite_origins', as_type=str, default='')
+    if vite_origins and not origin:
+        referer = request.META.get('HTTP_REFERER', '')
+        origin = '/'.join(referer.split('/', 3)[:3])
     if origin and vite_origins:
         origins_list = [o.strip() for o in vite_origins.strip().splitlines() if o.strip()]
         return origin in origins_list

src/pretix/settings.py

@@ -58,10 +58,11 @@ from django.utils.translation import gettext_lazy as _  # NOQA
 
 _config = configparser.RawConfigParser()
 if 'PRETIX_CONFIG_FILE' in os.environ:
-    _config.read_file(open(os.environ.get('PRETIX_CONFIG_FILE'), encoding='utf-8'))
+    config_files = [os.environ['PRETIX_CONFIG_FILE']]
 else:
-    _config.read(['/etc/pretix/pretix.cfg', os.path.expanduser('~/.pretix.cfg'), 'pretix.cfg'],
-                 encoding='utf-8')
+    config_files = ['/etc/pretix/pretix.cfg', os.path.expanduser('~/.pretix.cfg'), 'pretix.cfg']
+
+_config.read(config_files, encoding='utf-8')
 config = EnvOrParserConfig(_config)
 
 CONFIG_FILE = config
@@ -704,7 +705,7 @@ if config.has_option('sentry', 'dsn') and not any(c in sys.argv for c in ('shell
     from sentry_sdk.integrations.logging import (
         LoggingIntegration, ignore_logger,
     )
-    from sentry_sdk.scrubber import EventScrubber, DEFAULT_DENYLIST
+    from sentry_sdk.scrubber import DEFAULT_DENYLIST, EventScrubber
 
     from .sentry import PretixSentryIntegration, setup_custom_filters
 
@@ -895,3 +896,14 @@ VITE_DEV_SERVER = f"http://localhost:{VITE_DEV_SERVER_PORT}"
 VITE_DEV_MODE = DEBUG
 VITE_IGNORE = False  # Used to ignore `collectstatic`/`rebuild`
 PRETIX_WIDGET_VITE = os.environ.get('PRETIX_WIDGET_VITE', '') not in ('', '0')
+
+if DEBUG:
+    # Reload if settings file changes
+    config_files_to_watch = [Path(x).absolute() for x in config_files]
+
+    from django.dispatch import receiver
+    from django.utils.autoreload import BaseReloader, autoreload_started
+
+    @receiver(autoreload_started, dispatch_uid="pretix_watch_config_file")
+    def watch_config_file(sender: BaseReloader, *args, **kwargs):
+        sender.extra_files.update(config_files_to_watch)

src/pretix/static/jsi18n/en/djangojs.js

@@ -1,5 +1,4 @@
 
-
 'use strict';
 {
   const globals = this;

src/pretix/static/pretixbase/js/asynctask.js

@@ -174,15 +174,16 @@ function async_task_error(jqXHR, textStatus, errorThrown) {
         var respdom = $(jqXHR.responseText);
         var c = respdom.filter('.container');
         if (respdom.filter('form') && (respdom.filter('.has-error') || respdom.filter('.alert-danger'))) {
-            // This is a failed form validation, let's just use it
-
             if (respdom.filter('#page-wrapper') && $('#page-wrapper').length) {
+                // This is a failed form validation, let's just use it
                 async_task_replace_page("#page-wrapper", respdom.find("#page-wrapper").html());
             } else {
                 async_task_replace_page("body", jqXHR.responseText.substring(
                     jqXHR.responseText.indexOf("<body"),
                     jqXHR.responseText.indexOf("</body")
                 ));
+                document.dispatchEvent(new Event("pretix:async-task-error"))
+
             }
 
         } else if (c.length > 0) {

src/pretix/static/pretixbase/js/errors.js

@@ -1,5 +1,11 @@
-document.getElementById('goback').onclick =
-   function() {window.history.back()};
-
-document.getElementById('reload').onclick =
- function() {window.location.reload(true)};
+['DOMContentLoaded', 'pretix:async-task-error'].forEach(function (ev) {
+  document.addEventListener(ev, function () {
+    document.querySelectorAll('#goback, #reload').forEach(function (element) {
+      const regularLoad = ev === 'DOMContentLoaded' && element.id === 'goback';
+      element.addEventListener('click', regularLoad
+        ? () => window.history.back()
+        : () => window.location.reload()
+      );
+    });
+  });
+});

src/pretix/static/pretixcontrol/js/ui/checkinrules/App.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import { computed } from 'vue'
-import { rules as rawRules, items, allProducts, limitProducts } from './django-interop'
+import { rules as rawRules, allItems, activeItems, allProducts, limitProducts } from './django-interop'
 import { convertToDNF } from './jsonlogic-boolalg'
 
 import RulesEditor from './checkin-rules-editor.vue'
@@ -53,7 +53,7 @@ const missingItems = computed(() => {
 	}
 
 	let missing = []
-	for (const item of items.value) {
+	for (const item of activeItems.value) {
 		if (productsSeen[item.id]) continue
 		if (!allProducts.value && !limitProducts.value.includes(item.id)) continue
 		if (item.variations.length > 0) {
@@ -87,7 +87,7 @@ const missingItems = computed(() => {
 
 		//- Tab panes
 		.tab-content
-			#rules-edit.tab-pane.active(v-if="items", role="tabpanel")
+			#rules-edit.tab-pane.active(v-if="allItems", role="tabpanel")
 				RulesEditor
 			#rules-viz.tab-pane(role="tabpanel")
 				RulesVisualization

src/pretix/static/pretixcontrol/js/ui/checkinrules/django-interop.ts

@@ -26,11 +26,13 @@ watch(rules, (newVal) => {
 	rulesInput.value = JSON.stringify(newVal)
 }, { deep: true })
 
-export const items = ref<any[]>([])
+export const activeItems = ref<any[]>([])
+export const allItems = ref<any[]>([])
 
 const itemsEl = document.querySelector('#items')
 if (itemsEl?.textContent) {
-	items.value = JSON.parse(itemsEl.textContent || '[]')
+	allItems.value = JSON.parse(itemsEl.textContent || '[]')
+	activeItems.value = allItems.value.filter(item => item.active)
 
 	function checkForInvalidIds (validProducts: Record<string, string>, validVariations: Record<string, string>, rule: any) {
 		if (rule['and']) {
@@ -57,8 +59,8 @@ if (itemsEl?.textContent) {
 	}
 
 	checkForInvalidIds(
-		Object.fromEntries(items.value.map(p => [p.id, p.name])),
-		Object.fromEntries(items.value.flatMap(p => p.variations?.map(v => [v.id, p.name + ' – ' + v.name]) ?? [])),
+		Object.fromEntries(allItems.value.map(p => [p.id, p.name])),
+		Object.fromEntries(allItems.value.flatMap(p => p.variations?.map(v => [v.id, p.name + ' – ' + v.name]) ?? [])),
 		rules.value
 	)
 }

src/pretix/static/pretixcontrol/js/ui/main.js

@@ -639,11 +639,13 @@ var form_handlers = function (el) {
                         ).append(" ").append($("<div>").text(res.organizer).html())
                     );
                 }
-                $ret.append(
-                    $("<span>").addClass("event-daterange").append(
-                        $("<span>").addClass("fa fa-calendar fa-fw")
-                    ).append(" ").append(res.date_range)
-                );
+                if (res.date_range) {
+                    $ret.append(
+                        $("<span>").addClass("event-daterange").append(
+                            $("<span>").addClass("fa fa-calendar fa-fw")
+                        ).append(" ").append(res.date_range)
+                    );
+                }
                 return $ret;
             },
         }).on("select2:select", function () {

src/pretix/static/pretixcontrol/scss/main.scss

@@ -864,6 +864,9 @@ tbody th {
 .checkin-sim-result-status-incomplete {
     background: $brand-primary;
 }
+.checkin-sim-result-status-exchange {
+    background: $brand-primary;
+}
 .checkin-sim-result-status-error {
     background: $brand-danger;
 }

src/pretix/static/pretixpresale/js/widget/widget.js

@@ -2051,9 +2051,16 @@ var shared_root_methods = {
             this.$root.set_cart_id(data.cart_id);
             this.$root.overlay.frame_loading = false;
             callback()
-        }, () => {
+        }, (xhr, data) => {
+          if (xhr.status === 429 && typeof xhr.responseURL !== "undefined") {
+            this.$root.overlay.error_message = strings['cart_error_429'];
+            this.$root.overlay.frame_loading = false;
+            this.$root.overlay.error_url_after = this.$root.newTabTarget;
+            this.$root.overlay.error_url_after_new_tab = true;
+          } else {
             this.$root.overlay.error_message = strings['cart_error'];
             this.$root.overlay.frame_loading = false;
+          }
         })
     },
     get_cart_id: function() {
@@ -2142,7 +2149,14 @@ var shared_root_computed = {
         if (this.subevent) {
             target = this.target_url + this.subevent + '/';
         }
-        return target;
+        var parameters = this.$root.consent_parameter
+        if (this.$root.additionalURLParams) {
+          parameters += `&${this.$root.additionalURLParams}`
+        }
+        if (parameters) {
+          target += '?' + parameters.replace(/^&/, '')
+        }
+        return target
     },
     useIframe: function () {
         if (window.crossOriginIsolated === true) {

src/pretix/static/pretixpresale/widget/src/sharedStore.ts

@@ -162,7 +162,15 @@ export function createWidgetStore (config: {
 				return params.toString()
 			},
 			newTabTarget (): string {
-				return this.subevent ? `${this.targetUrl}${this.subevent}/` : this.targetUrl
+				let url = this.subevent ? `${this.targetUrl}${this.subevent}/` : this.targetUrl
+				let parameters = this.consentParameter
+				if (this.additionalURLParams) {
+					parameters += `&${this.additionalURLParams}`
+				}
+				if (parameters) {
+					url += '?' + parameters.replace(/^&/, '')
+				}
+				return url
 			},
 			formTarget (): string {
 				const isFirefox = navigator.userAgent.toLowerCase().includes('firefox')
@@ -441,6 +449,7 @@ export function createWidgetStore (config: {
 							this.overlay.frameLoading = false
 							this.overlay.errorUrlAfter = this.newTabTarget
 							this.overlay.errorUrlAfterNewTab = true
+							return
 						} else if (e.status === 405) {
 							// Likely a redirect!
 							this.targetUrl = e.responseUrl.substring(0, e.responseUrl.indexOf('/cart/add') - 18)
@@ -460,11 +469,18 @@ export function createWidgetStore (config: {
 					this.overlay.frameLoading = true
 					const data = await createCart(url)
 					this.setCartId(data.cart_id)
+					return true
 				} catch (e) {
-					if (e instanceof ApiError && (e.status === 200 || (e.status >= 400 && e.status < 500))) {
+					if (e instanceof ApiError && e.status === 429) {
+						this.overlay.errorMessage = STRINGS.cart_error_429
+						this.overlay.frameLoading = false
+						this.overlay.errorUrlAfter = this.newTabTarget
+						this.overlay.errorUrlAfterNewTab = true
+					} else if (e instanceof ApiError && (e.status === 200 || (e.status >= 400 && e.status < 500))) {
 						this.overlay.errorMessage = STRINGS.cart_error
 						this.overlay.frameLoading = false
 					}
+					return false
 				}
 			},
 			redeem (voucherCode: string, event?: Event) {
@@ -484,7 +500,7 @@ export function createWidgetStore (config: {
 			async resume () {
 				if (!this.cartId && this.keepCart) {
 					// create an empty cart whose id we can persist
-					await this.createCart()
+					if (!await this.createCart()) return
 				}
 				let redirectUrl = `${this.targetUrl}w/${globalWidgetId}/`
 				if (this.subevent && this.isButton && this.items.length === 0) {

src/tests/api/test_checkin.py

@@ -1098,6 +1098,27 @@ def test_question_upload(token_client, organizer, clist, event, order, question)
         assert order.positions.first().answers.get(question=question[0]).file
 
 
+@pytest.mark.django_db
+def test_question_upload_optional(token_client, organizer, clist, event, order, question):
+    with scopes_disabled():
+        p = order.positions.first()
+    question[0].type = 'F'
+    question[0].required = False
+    question[0].save()
+
+    resp = _redeem(token_client, organizer, clist, p.pk, {})
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'incomplete'
+    with scopes_disabled():
+        assert resp.data['questions'] == [QuestionSerializer(question[0]).data]
+
+    resp = _redeem(token_client, organizer, clist, p.pk, {'answers': {question[0].pk: ""}})
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+    with scopes_disabled():
+        assert not order.positions.first().answers.filter(question=question[0]).exists()
+
+
 @pytest.mark.django_db
 def test_store_failed(token_client, organizer, clist, event, order):
     with scopes_disabled():

src/tests/api/test_checkinrpc.py

@@ -34,7 +34,7 @@ from tests.const import SAMPLE_PNG
 
 from pretix.api.serializers.item import QuestionSerializer
 from pretix.base.models import (
-    Checkin, InvoiceAddress, Order, OrderPosition, ReusableMedium,
+    Checkin, InvoiceAddress, Item, Order, OrderPosition, ReusableMedium,
 )
 
 # Lots of this code is overlapping with test_checkin.py, and some of it is arguably redundant since it's triggering
@@ -286,12 +286,12 @@ def test_by_secret_special_chars(token_client, organizer, clist, event, order):
 @pytest.mark.django_db
 def test_by_medium(token_client, organizer, clist, event, order):
     with scopes_disabled():
-        ReusableMedium.objects.create(
+        rm = ReusableMedium.objects.create(
             type="barcode",
             identifier="abcdef",
             organizer=organizer,
-            linked_orderposition=order.positions.first(),
         )
+        rm.linked_orderpositions.add(order.positions.first())
     resp = _redeem(token_client, organizer, clist, "abcdef", {"source_type": "barcode"})
     assert resp.status_code == 201
     assert resp.data['status'] == 'ok'
@@ -301,6 +301,71 @@ def test_by_medium(token_client, organizer, clist, event, order):
     assert ci.raw_source_type == "barcode"
 
 
+@pytest.mark.django_db
+def test_by_medium_multiple_orderpositions(token_client, organizer, clist_all, event, order):
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="barcode",
+            identifier="abcdef",
+            organizer=organizer,
+        )
+        op_item_first = order.positions.first()
+        rm.linked_orderpositions.add(op_item_first)
+        op_item_other = order.positions.all()[1]
+        rm.linked_orderpositions.add(op_item_other)
+
+    # multiple tickets are valid => no check-in
+    resp = _redeem(token_client, organizer, clist_all, "abcdef", {"source_type": "barcode"})
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'ambiguous'
+
+    with scopes_disabled():
+        op_item_other.valid_from = datetime.datetime(2020, 1, 1, 12, 0, 0, tzinfo=event.timezone)
+        op_item_other.valid_until = datetime.datetime(2020, 1, 1, 15, 0, 0, tzinfo=event.timezone)
+        op_item_other.save()
+
+    with freeze_time("2020-01-01 13:45:00"):
+        # multiple tickets are valid => no check-in
+        resp = _redeem(token_client, organizer, clist_all, "abcdef", {"source_type": "barcode"})
+        assert resp.status_code == 400
+        assert resp.data['status'] == 'error'
+        assert resp.data['reason'] == 'ambiguous'
+
+    with freeze_time("2020-01-01 10:45:00"):
+        resp = _redeem(token_client, organizer, clist_all, "abcdef", {"source_type": "barcode"})
+        assert resp.status_code == 201
+        assert resp.data['status'] == 'ok'
+
+    with freeze_time("2020-01-01 15:45:00"):
+        resp = _redeem(token_client, organizer, clist_all, "abcdef", {"source_type": "barcode"})
+        assert resp.status_code == 400
+        assert resp.data['status'] == 'error'
+        assert resp.data['reason'] == 'already_redeemed'
+
+    with scopes_disabled():
+        op_item_first.valid_from = datetime.datetime(2020, 1, 1, 10, 0, 0, tzinfo=event.timezone)
+        op_item_first.valid_until = datetime.datetime(2020, 1, 1, 12, 0, 0, tzinfo=event.timezone)
+        op_item_first.save()
+
+    with freeze_time("2020-01-01 15:45:00"):
+        resp = _redeem(token_client, organizer, clist_all, "abcdef", {"source_type": "barcode"})
+        assert resp.status_code == 400
+        assert resp.data['status'] == 'error'
+        assert resp.data['reason'] == 'invalid_time'
+
+    with scopes_disabled():
+        op_item_first.canceled = True
+        op_item_first.save()
+        op_item_other.canceled = True
+        op_item_other.save()
+
+    resp = _redeem(token_client, organizer, clist_all, "abcdef", {"source_type": "barcode"})
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'canceled'
+
+
 @pytest.mark.django_db
 def test_by_medium_not_connected(token_client, organizer, clist, event, order):
     with scopes_disabled():
@@ -318,12 +383,12 @@ def test_by_medium_not_connected(token_client, organizer, clist, event, order):
 @pytest.mark.django_db
 def test_by_medium_wrong_event(token_client, organizer, clist, event, order2):
     with scopes_disabled():
-        ReusableMedium.objects.create(
+        rm = ReusableMedium.objects.create(
             type="barcode",
             identifier="abcdef",
             organizer=organizer,
-            linked_orderposition=order2.positions.first(),
         )
+        rm.linked_orderpositions.add(order2.positions.first())
     resp = _redeem(token_client, organizer, clist, "abcdef", {"source_type": "barcode"})
     assert resp.status_code == 404
     assert resp.data['status'] == 'error'
@@ -337,12 +402,12 @@ def test_by_medium_wrong_event(token_client, organizer, clist, event, order2):
 @pytest.mark.django_db
 def test_by_medium_wrong_type(token_client, organizer, clist, event, order):
     with scopes_disabled():
-        ReusableMedium.objects.create(
+        rm = ReusableMedium.objects.create(
             type="nfc_uid",
             identifier="abcdef",
             organizer=organizer,
-            linked_orderposition=order.positions.first(),
         )
+        rm.linked_orderpositions.add(order.positions.first())
     resp = _redeem(token_client, organizer, clist, "abcdef", {"source_type": "barcode"})
     assert resp.status_code == 404
     assert resp.data['status'] == 'error'
@@ -355,13 +420,13 @@ def test_by_medium_wrong_type(token_client, organizer, clist, event, order):
 @pytest.mark.django_db
 def test_by_medium_inactive(token_client, organizer, clist, event, order):
     with scopes_disabled():
-        ReusableMedium.objects.create(
+        rm = ReusableMedium.objects.create(
             type="barcode",
             identifier="abcdef",
             organizer=organizer,
             active=False,
-            linked_orderposition=order.positions.first(),
         )
+        rm.linked_orderpositions.add(order.positions.first())
     resp = _redeem(token_client, organizer, clist, "abcdef", {"source_type": "barcode"})
     assert resp.status_code == 404
     assert resp.data['status'] == 'error'
@@ -1188,3 +1253,489 @@ def test_annul_failures(device_client, team, organizer, clist, clist_event2, eve
     with scopes_disabled():
         ci = p.all_checkins.get()
         assert ci.successful
+
+
+@pytest.mark.django_db
+def test_exchange_incomplete_body(token_client, organizer, clist, event, order):
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid"
+    })
+    assert resp.status_code == 400
+    assert resp.data == {
+        'non_field_errors': ['If you set any of exchange_medium_type or exchange_medium_identifier, you need to set both of them.']
+    }
+
+
+@pytest.mark.django_db
+def test_exchange_medium_for_medium(token_client, organizer, clist, event, order):
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="barcode",
+            identifier="abcdef",
+            organizer=organizer,
+        )
+        rm.linked_orderpositions.add(order.positions.first())
+    resp = _redeem(token_client, organizer, clist, "abcdef", {
+        "source_type": "barcode",
+        "exchange_medium_type": "barcode",
+        "exchange_medium_identifier": "hijkl",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'error'
+
+
+@pytest.mark.django_db
+def test_exchange_unknown_media_type(token_client, organizer, clist, event, order):
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "unknown",
+        "exchange_medium_identifier": "hijkl",
+    })
+    assert resp.status_code == 400
+    assert resp.data == {"exchange_medium_type": ["\"unknown\" is not a valid choice."]}
+
+
+@pytest.mark.django_db
+def test_exchange_disabled_media_type(token_client, organizer, clist, event, order):
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "hijkl",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'error'
+    assert resp.data['reason_explanation'] == 'Medium type is not enabled for organizer.'
+
+
+@pytest.mark.django_db
+def test_exchange_mismatch_media_type(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "barcode"
+    item.save()
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "12345678",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'product'
+    assert resp.data['reason_explanation'] == 'Incorrect medium type for product.'
+
+
+@pytest.mark.django_db
+def test_exchange_no_item_policy(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.save()
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "12345678",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'product'
+    assert resp.data['reason_explanation'] == 'Product does not support medium exchange.'
+
+
+@pytest.mark.django_db
+def test_exchange_reuse_or_new_new(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_REUSE_OR_NEW
+    item.save()
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "12345678",
+    })
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+    with scopes_disabled():
+        rm = ReusableMedium.objects.get(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+        assert rm.linked_orderpositions.get().secret == "z3fsn8jyufm5kpk768q69gkbyr5f4h6w"
+
+
+@pytest.mark.django_db
+def test_exchange_reuse_or_new_reuse_replace(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_REUSE_OR_NEW
+    item.save()
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+        rm.linked_orderpositions.add(order.positions.last())
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "12345678",
+    })
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+    rm.refresh_from_db()
+    with scopes_disabled():
+        assert rm.linked_orderpositions.get().secret == "z3fsn8jyufm5kpk768q69gkbyr5f4h6w"
+
+
+@pytest.mark.django_db
+def test_exchange_reuse_or_new_reuse_append(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_APPEND_OR_NEW
+    item.save()
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+        rm.linked_orderpositions.add(order.positions.last())
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "12345678",
+    })
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+    rm.refresh_from_db()
+    with scopes_disabled():
+        assert rm.linked_orderpositions.count() == 2
+        assert rm.linked_orderpositions.filter(secret="z3fsn8jyufm5kpk768q69gkbyr5f4h6w").exists()
+
+
+@pytest.mark.django_db
+def test_exchange_reuse_exists_append(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_APPEND_OR_NEW
+    item.save()
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+        rm.linked_orderpositions.add(order.positions.last())
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "12345678",
+    })
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+    rm.refresh_from_db()
+    with scopes_disabled():
+        assert rm.linked_orderpositions.count() == 2
+        assert rm.linked_orderpositions.filter(secret="z3fsn8jyufm5kpk768q69gkbyr5f4h6w").exists()
+
+
+@pytest.mark.django_db
+def test_exchange_reuse_expired(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_REUSE
+    item.save()
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+            expires=now() - datetime.timedelta(hours=2),
+        )
+        rm.linked_orderpositions.add(order.positions.last())
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "12345678",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'medium_invalid'
+
+
+@pytest.mark.django_db
+def test_exchange_reuse_not_exists(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_REUSE
+    item.save()
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "12345678",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'medium_invalid'
+
+
+@pytest.mark.django_db
+def test_exchange_new_exists(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_NEW
+    item.save()
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+        rm.linked_orderpositions.add(order.positions.last())
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "12345678",
+        "exchange_link_action": "append",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'medium_exists'
+
+
+@pytest.mark.django_db
+def test_exchange_new_not_exists(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_NEW
+    item.save()
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "12345678",
+        "exchange_link_action": "replace",
+    })
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+    with scopes_disabled():
+        rm = ReusableMedium.objects.get(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+        assert rm.linked_orderpositions.get().secret == "z3fsn8jyufm5kpk768q69gkbyr5f4h6w"
+
+
+@pytest.mark.django_db
+def test_exchange_required(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_NEW
+    item.save()
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'exchange'
+    assert resp.data['media_policy'] == 'new'
+    assert resp.data['media_type'] == 'nfc_uid'
+
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+        rm.linked_orderpositions.add(order.positions.first())
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+    })
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+    # Force works
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "force": True,
+    })
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+
+
+@pytest.mark.django_db
+def test_exchanged_original_barcode_ok(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_NEW
+    item.save()
+
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+        rm.linked_orderpositions.add(order.positions.first())
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+    })
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+
+
+@pytest.mark.django_db
+def test_exchanged_original_barcode_not_ok(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    organizer.settings.reusable_media_usage_enforced = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_NEW
+    item.save()
+
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+        rm.linked_orderpositions.add(order.positions.first())
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'already_exchanged'
+    # Force works
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "force": True,
+    })
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+
+
+@pytest.mark.django_db
+def test_exchanged_scan_medium_ok(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    organizer.settings.reusable_media_usage_enforced = True
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_NEW
+    item.save()
+
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+        rm.linked_orderpositions.add(order.positions.first())
+    resp = _redeem(token_client, organizer, clist, "12345678", {
+        "source_type": "nfc_uid",
+    })
+    assert resp.status_code == 201
+    assert resp.data['status'] == 'ok'
+
+
+@pytest.mark.django_db
+def test_exchanged_double_exchange(token_client, organizer, clist, event, order, item):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    organizer.settings.reusable_media_usage_enforced = False
+    item.media_type = "nfc_uid"
+    item.media_policy = Item.MEDIA_POLICY_NEW
+    item.save()
+
+    with scopes_disabled():
+        rm = ReusableMedium.objects.create(
+            type="nfc_uid",
+            identifier="12345678",
+            organizer=organizer,
+        )
+        rm.linked_orderpositions.add(order.positions.first())
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "87654321",
+        "exchange_link_action": "replace",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'already_exchanged'
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize(
+    "media_policy,media_type",
+    [
+        (Item.MEDIA_POLICY_NEW, "nfc_mf0aes"),
+        (Item.MEDIA_POLICY_REUSE_OR_NEW, "nfc_mf0aes"),
+        (Item.MEDIA_POLICY_APPEND_OR_NEW, "nfc_mf0aes"),
+        (Item.MEDIA_POLICY_NEW, "barcode"),
+        (Item.MEDIA_POLICY_REUSE_OR_NEW, "barcode"),
+        (Item.MEDIA_POLICY_APPEND_OR_NEW, "barcode"),
+    ]
+)
+def test_exchange_unsupported_media_type_for_new(token_client, organizer, clist, event, order, item, media_policy, media_type):
+    organizer.settings.set(f'reusable_media_type_{media_type}', True)
+    # Shouldn't be configurable, but test that the logic is solid anyway
+    item.media_type = media_type
+    item.media_policy = media_policy
+    item.save()
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": media_type,
+        "exchange_medium_identifier": "12345678",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'medium_invalid'
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize(
+    "media_policy",
+    [
+        Item.MEDIA_POLICY_NEW,
+        Item.MEDIA_POLICY_REUSE_OR_NEW,
+        Item.MEDIA_POLICY_APPEND_OR_NEW,
+    ]
+)
+def test_exchange_rejected_media_identifier(token_client, organizer, clist, event, order, item, media_policy):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    item.media_type = "nfc_uid"
+    item.media_policy = media_policy
+    item.save()
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "08RANDOM",
+    })
+    assert resp.status_code == 400
+    assert resp.data['status'] == 'error'
+    assert resp.data['reason'] == 'medium_invalid'
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize(
+    "media_policy",
+    [
+        Item.MEDIA_POLICY_NEW,
+        Item.MEDIA_POLICY_REUSE_OR_NEW,
+        Item.MEDIA_POLICY_APPEND_OR_NEW,
+    ]
+)
+def test_exchange_create_gift_card(token_client, organizer, clist, event, order, item, media_policy):
+    organizer.settings.reusable_media_type_nfc_uid = True
+    organizer.settings.reusable_media_type_nfc_uid_autocreate_giftcard = True
+    organizer.settings.reusable_media_type_nfc_uid_autocreate_giftcard_currency = "EUR"
+    item.media_type = "nfc_uid"
+    item.media_policy = media_policy
+    item.save()
+    resp = _redeem(token_client, organizer, clist, "z3fsn8jyufm5kpk768q69gkbyr5f4h6w", {
+        "source_type": "barcode",
+        "exchange_medium_type": "nfc_uid",
+        "exchange_medium_identifier": "0412345",
+    })
+    assert resp.status_code == 201
+    with scopes_disabled():
+        rm = ReusableMedium.objects.get(identifier="0412345")
+        assert rm.linked_giftcard.currency == "EUR"

src/tests/api/test_order_create.py

@@ -3121,9 +3121,68 @@ def test_order_create_use_medium(token_client, organizer, event, item, quota, qu
     with scopes_disabled():
         o = Order.objects.get(code=resp.data['code'])
         medium.refresh_from_db()
-        assert o.positions.first() == medium.linked_orderposition
+        assert o.positions.first() == medium.linked_orderpositions.first()
         assert resp.data['positions'][0]['pdf_data']['medium_identifier'] == medium.identifier
 
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/{}/orders/?pdf_data=true'.format(
+            organizer.slug, event.slug
+        ), format='json', data=res
+    )
+    assert resp.status_code == 201
+    with scopes_disabled():
+        o = Order.objects.get(code=resp.data['code'])
+        medium.refresh_from_db()
+        assert medium.linked_orderpositions.count() == 1
+        assert o.positions.first() == medium.linked_orderpositions.first()
+        assert resp.data['positions'][0]['pdf_data']['medium_identifier'] == medium.identifier
+
+
+@pytest.mark.django_db
+def test_order_create_add_to_medium(token_client, organizer, event, item, quota, question, medium):
+    item.media_type = medium.type
+    item.media_policy = Item.MEDIA_POLICY_APPEND_OR_NEW
+    item.save()
+    res = copy.deepcopy(ORDER_CREATE_PAYLOAD)
+    res['positions'][0]['item'] = item.pk
+    res['positions'][0]['use_reusable_medium'] = medium.pk
+    res['positions'][0]['answers'][0]['question'] = question.pk
+
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/{}/orders/?pdf_data=true'.format(
+            organizer.slug, event.slug
+        ), format='json', data=res
+    )
+    assert resp.status_code == 201
+    with scopes_disabled():
+        medium.refresh_from_db()
+        assert medium.linked_orderpositions.count() == 1
+
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/{}/orders/?pdf_data=true'.format(
+            organizer.slug, event.slug
+        ), format='json', data=res
+    )
+    assert resp.status_code == 201
+    with scopes_disabled():
+        medium.refresh_from_db()
+        assert medium.linked_orderpositions.count() == 2
+
+    item.media_policy = Item.MEDIA_POLICY_REUSE_OR_NEW
+    item.save()
+    res['positions'][0]['use_reusable_medium'] = medium.pk
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/{}/orders/?pdf_data=true'.format(
+            organizer.slug, event.slug
+        ), format='json', data=res
+    )
+    assert resp.status_code == 201
+    with scopes_disabled():
+        o = Order.objects.get(code=resp.data['code'])
+        medium.refresh_from_db()
+        assert medium.linked_orderpositions.count() == 1
+        assert o.positions.first() == medium.linked_orderpositions.first()
+
 
 @pytest.mark.django_db
 def test_order_create_use_medium_other_organizer(token_client, organizer, event, item, quota, question, medium2):
@@ -3168,7 +3227,7 @@ def test_order_create_create_medium(token_client, organizer, event, item, quota,
         i = resp.data['positions'][0]['pdf_data']['medium_identifier']
         assert i
         m = organizer.reusable_media.get(identifier=i)
-        assert m.linked_orderposition == o.positions.first()
+        assert m.linked_orderpositions.first() == o.positions.first()
         assert m.type == "barcode"
 
 

src/tests/api/test_reusable_media.py

@@ -89,10 +89,13 @@ TEST_MEDIUM_RES = {
     "organizer": "dummy",
     "identifier": "ABCDEFGH",
     "type": "barcode",
+    "claim_token": None,
+    "label": None,
     "active": True,
     "expires": None,
     "customer": None,
     "linked_orderposition": None,
+    "linked_orderpositions": [],
     "linked_giftcard": None,
     "notes": None,
     "info": {},
@@ -170,7 +173,7 @@ def test_medium_detail(token_client, organizer, event, medium, giftcard, custome
         ticket = event.items.create(name='Early-bird ticket', category=None, default_price=23, admission=True,
                                     personalized=True)
         op = o.positions.create(item=ticket, price=Decimal("14"))
-        medium.linked_orderposition = op
+        medium.linked_orderpositions.add(op)
         medium.linked_giftcard = giftcard
         medium.customer = customer
         medium.save()
@@ -273,7 +276,7 @@ def test_medium_detail_event_permission_missing(token_client, organizer, event,
         ticket = event.items.create(name='Early-bird ticket', category=None, default_price=23, admission=True,
                                     personalized=True)
         op = o.positions.create(item=ticket, price=Decimal("14"))
-        medium.linked_orderposition = op
+        medium.linked_orderpositions.add(op)
         medium.linked_giftcard = giftcard
         medium.customer = customer
         medium.save()
@@ -352,6 +355,110 @@ def test_medium_create(token_client, organizer, giftcard):
         assert m.updated > now() - timedelta(minutes=10)
 
 
+@pytest.mark.django_db
+def test_medium_create_linked_orderposition(token_client, organizer, event, org2_event, medium):
+    with scopes_disabled():
+        o = Order.objects.create(
+            code='FOO', event=event, email='dummy@dummy.test',
+            status=Order.STATUS_PENDING, datetime=now(), expires=now() + timedelta(days=10),
+            sales_channel=event.organizer.sales_channels.get(identifier="web"),
+            total=14, locale='en'
+        )
+        ticket = event.items.create(name='Early-bird ticket', category=None, default_price=23, admission=True,
+                                         personalized=True)
+        op = o.positions.create(item=ticket, price=Decimal("14"))
+        op2 = o.positions.create(item=ticket, price=Decimal("14"))
+
+        org2_o = Order.objects.create(
+            code='FOO', event=org2_event, email='dummy@dummy.test',
+            status=Order.STATUS_PENDING, datetime=now(), expires=now() + timedelta(days=10),
+            sales_channel=org2_event.organizer.sales_channels.get(identifier="web"),
+            total=14, locale='en'
+        )
+        org2_ticket = org2_event.items.create(name='Early-bird ticket', category=None, default_price=23, admission=True,
+                                                   personalized=True)
+        org2_op = org2_o.positions.create(item=org2_ticket, price=Decimal("14"))
+
+    payload = dict(TEST_MEDIUM_CREATE_PAYLOAD)
+
+    # wrong orderposition for organizer
+    payload['linked_orderposition'] = org2_op.pk
+    resp = token_client.post(
+        '/api/v1/organizers/{}/reusablemedia/'.format(organizer.slug),
+        payload,
+        format='json'
+    )
+    assert resp.status_code == 400
+
+    # unkown orderposition
+    payload['linked_orderposition'] = "unknown"
+    resp = token_client.post(
+        '/api/v1/organizers/{}/reusablemedia/'.format(organizer.slug),
+        payload,
+        format='json'
+    )
+    assert resp.status_code == 400
+
+    # create with linked_orderposition
+    payload['linked_orderposition'] = op.pk
+    resp = token_client.post(
+        '/api/v1/organizers/{}/reusablemedia/'.format(organizer.slug),
+        payload,
+        format='json'
+    )
+    assert resp.status_code == 201
+    with scopes_disabled():
+        m = ReusableMedium.objects.get(pk=resp.data['id'])
+        assert list(m.linked_orderpositions.values_list('pk', flat=True)) == [op.pk]
+
+    # double-check API-response for fallback-values
+    resp = token_client.get(
+        '/api/v1/organizers/{}/reusablemedia/{}/'.format(organizer.slug, resp.data['id'])
+    )
+    assert resp.status_code == 200
+    assert resp.data['linked_orderposition'] == op.pk
+    assert resp.data['linked_orderpositions'] == [op.pk]
+
+    # create with linked_orderposition and linked_orderpositions (not allowed)
+    payload['identifier'] = "FOOBAZ"
+    payload['linked_orderpositions'] = [op.pk, org2_op.pk]
+    resp = token_client.post(
+        '/api/v1/organizers/{}/reusablemedia/'.format(organizer.slug),
+        payload,
+        format='json'
+    )
+    assert resp.status_code == 400
+
+    # multiple linked_orderpositions, but from different organizers
+    del payload['linked_orderposition']
+    resp = token_client.post(
+        '/api/v1/organizers/{}/reusablemedia/'.format(organizer.slug),
+        payload,
+        format='json'
+    )
+    assert resp.status_code == 400
+
+    # multiple linked_orderpositions from same organizer
+    payload['linked_orderpositions'] = [op.pk, op2.pk]
+    resp = token_client.post(
+        '/api/v1/organizers/{}/reusablemedia/'.format(organizer.slug),
+        payload,
+        format='json'
+    )
+    assert resp.status_code == 201
+    with scopes_disabled():
+        m = ReusableMedium.objects.get(pk=resp.data['id'])
+        assert list(m.linked_orderpositions.values_list('pk', flat=True)) == [op.pk, op2.pk]
+
+    # double-check API-response for fallback-values
+    resp = token_client.get(
+        '/api/v1/organizers/{}/reusablemedia/{}/'.format(organizer.slug, resp.data['id'])
+    )
+    assert resp.status_code == 200
+    assert resp.data['linked_orderposition'] is None
+    assert resp.data['linked_orderpositions'] == [op.pk, op2.pk]
+
+
 @pytest.mark.django_db
 def test_medium_foreignkeyval(token_client, organizer, giftcard2):
     payload = dict(TEST_MEDIUM_CREATE_PAYLOAD)
@@ -398,6 +505,68 @@ def test_medium_patch(token_client, organizer, event, medium, giftcard, customer
     assert medium.info == {'test': 2}
     assert medium.identifier == "ABCDEFGH"
 
+    # test patch with linked_orderpositions
+    with scopes_disabled():
+        o = Order.objects.create(
+            code='FOO', event=event, email='dummy@dummy.test',
+            status=Order.STATUS_PENDING, datetime=now(), expires=now() + timedelta(days=10),
+            sales_channel=event.organizer.sales_channels.get(identifier="web"),
+            total=14, locale='en'
+        )
+        ticket = event.items.create(name='Early-bird ticket', category=None, default_price=23, admission=True,
+                                         personalized=True)
+        op = o.positions.create(item=ticket, price=Decimal("14"))
+        op2 = o.positions.create(item=ticket, price=Decimal("14"))
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/reusablemedia/{}/'.format(organizer.slug, medium.pk),
+        {
+            'linked_orderposition': op.pk,
+        },
+        format='json'
+    )
+    assert resp.status_code == 200
+    medium.refresh_from_db()
+    with scopes_disabled():
+        assert list(medium.linked_orderpositions.values_list('pk', flat=True)) == [op.pk]
+        assert medium.all_logentries().count() == 2
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/reusablemedia/{}/'.format(organizer.slug, medium.pk),
+        {
+            'linked_orderpositions': [op.pk, op2.pk],
+        },
+        format='json'
+    )
+    assert resp.status_code == 200
+    medium.refresh_from_db()
+    with scopes_disabled():
+        assert list(medium.linked_orderpositions.values_list('pk', flat=True)) == [op.pk, op2.pk]
+        assert medium.all_logentries().count() == 3
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/reusablemedia/{}/'.format(organizer.slug, medium.pk),
+        {
+            'linked_orderpositions': [op2.pk],
+        },
+        format='json'
+    )
+    assert resp.status_code == 200
+    medium.refresh_from_db()
+    with scopes_disabled():
+        assert list(medium.linked_orderpositions.values_list('pk', flat=True)) == [op2.pk]
+        assert medium.all_logentries().count() == 4
+
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/reusablemedia/{}/'.format(organizer.slug, medium.pk),
+        {
+            'linked_orderposition': op.pk,
+            'linked_orderpositions': [op.pk, op2.pk],
+        },
+        format='json'
+    )
+    assert resp.status_code == 400
+
 
 @pytest.mark.django_db
 def test_medium_no_deletion(token_client, organizer, event, medium):
@@ -538,7 +707,7 @@ def test_medium_lookup_cross_organizer(token_client, organizer, organizer2, org2
         ticket = org2_event.items.create(name='Early-bird ticket', category=None, default_price=23, admission=True,
                                          personalized=True)
         op = o.positions.create(item=ticket, price=Decimal("14"))
-        medium2.linked_orderposition = op
+        medium2.linked_orderpositions.add(op)
         medium2.linked_giftcard = giftcard2
         medium2.save()
 

src/tests/base/test_checkin.py

@@ -1186,7 +1186,7 @@ def test_rules_reasoning_prefer_number_over_date(event, position, clist):
 
 @pytest.mark.django_db(transaction=True)
 def test_position_queries(django_assert_max_num_queries, position, clist):
-    with django_assert_max_num_queries(13) as captured:
+    with django_assert_max_num_queries(12) as captured:
         perform_checkin(position, clist, {})
     if 'sqlite' not in settings.DATABASES['default']['ENGINE']:
         assert any('FOR UPDATE' in s['sql'] for s in captured)

src/tests/base/test_orders.py

@@ -4123,8 +4123,8 @@ def test_giftcard_multiple(event):
     for p in order.payments.all():
         p.payment_provider.execute_payment(None, p)
 
-    assert order.payments.get(info__icontains=gc1.pk).amount == Decimal('12.00')
-    assert order.payments.get(info__icontains=gc2.pk).amount == Decimal('11.00')
+    assert order.payments.get(amount=Decimal("12.00")).info_data["gift_card"] == gc1.pk
+    assert order.payments.get(amount=Decimal("11.00")).info_data["gift_card"] == gc2.pk
     gc1 = GiftCard.objects.get(pk=gc1.pk)
     assert gc1.value == 0
     gc2 = GiftCard.objects.get(pk=gc2.pk)

src/tests/control/test_permissions.py

@@ -137,6 +137,7 @@ event_urls = [
     "subevents/select2",
     "subevents/add",
     "subevents/2/delete",
+    "subevents/2/edit",
     "subevents/2/",
     "quotas/",
     "quotas/2/delete",
@@ -360,8 +361,9 @@ event_permission_urls = [
     ("event.items:write", "discounts/reorder", 400, HTTP_POST),
     ("event.items:write", "discounts/add", 200, HTTP_GET),
     (None, "subevents/", 200, HTTP_GET),
-    ("event.subevents:write", "subevents/2/", 404, HTTP_GET),
-    ("event.subevents:write", "subevents/2/", 404, HTTP_POST),
+    (None, "subevents/2/", 404, HTTP_GET),
+    ("event.subevents:write", "subevents/2/edit", 404, HTTP_GET),
+    ("event.subevents:write", "subevents/2/edit", 404, HTTP_POST),
     ("event.subevents:write", "subevents/2/delete", 404, HTTP_GET),
     ("event.subevents:write", "subevents/add", 200, HTTP_GET),
     ("event.subevents:write", "subevents/bulk_add", 200, HTTP_GET),

src/tests/control/test_subevents.py

@@ -110,9 +110,9 @@ class SubEventsTest(SoupTest):
             assert se.checkinlist_set.count() == 1
 
     def test_modify(self):
-        doc = self.get_doc('/control/event/ccc/30c3/subevents/%d/' % self.subevent1.pk)
+        doc = self.get_doc('/control/event/ccc/30c3/subevents/%d/edit' % self.subevent1.pk)
         assert doc.select("input[name=quotas-TOTAL_FORMS]")
-        doc = self.post_doc('/control/event/ccc/30c3/subevents/%d/' % self.subevent1.pk, {
+        doc = self.post_doc('/control/event/ccc/30c3/subevents/%d/edit' % self.subevent1.pk, {
             'name_0': 'SE2',
             'active': 'on',
             'date_from_0': '2017-07-01',

src/tests/e2e/conftest.py

@@ -731,11 +731,13 @@ def event_series(organizer):
     """Create an event series with multiple subevents, items, and quotas."""
     from pretix.base.models import ItemCategory
 
+    base_date = _future_dt(days=30, hour=19)
+
     event = Event.objects.create(
         organizer=organizer,
         name='Concert Series',
         slug='concert-series',
-        date_from=_future_dt(days=30, hour=19),
+        date_from=base_date,
         has_subevents=True,
         currency='EUR',
         live=True,
@@ -760,9 +762,8 @@ def event_series(organizer):
     )
 
     subevents = []
-    base_date = _future_dt(days=30, hour=19)
 
-    for i in range(15):
+    for i in range(20):
         se = SubEvent.objects.create(
             event=event,
             name=f'Concert Night {i + 1}',